AV-Lab's test of FREE malware scanners

[Deleted member 178]

In the modern world, both individual and corporate users reach from time to time for software presented in the report. Due to the growing number of easy to detect generic threats and reviving samples of malware which uses malicious scripts, the role of traditional scanners is no longer as important as it was before. All applications tested by AVLab enable users to select scanning destination, which is verified against infected files. In the test, we haven’t included scanners which offer only so called quick check for the most important system areas because it doesn’t include user personal folders so verification of virus collection is impossible.

Malicious code developers who have access to advanced tools, readymade guides, and even cybercriminal services, don’t make task easier for experts seconded to hard analytical work. On the other hand, scanner designers find it very difficult to reconcile performance of these solutions and constantly increasing number of virus signatures. Traditional scanning techniques are being phased out in favour of more advanced, automated techniques with ability to learn threats patterns. In addition, some developers completely abandon on-demand scanners, and others make use of cloud model, leaving the functionality to scan only the most important system areas (drivers, registry, and running processes).

The cost of maintaining infrastructure and access to high-speed internet connections which are necessary for proper and rapid operation of such applications, can represent financial burden for small developers. For this reason, we can observe fading interest in traditional antivirus scanners which can very precisely check every part of the operating system while maintaining acceptable performance. With this in mind, AVLab experts have decided that this is the last edition of similar test. Next year, the methodology will evolve towards detecting threats in already infected systems, including detection of malicious processes and registry keys as well as running system services. Outline www.AVLab.pl 2 / 6 In detection of several thousand malicious applications which were collected 24 hours before each test day, the best results were achieved by: Emsisoft Emergeny Kit, Trend Micro HouseCall, Dr.Web CureIt, Kaspersky Removal Tool, ESET Online Scanner, and Comodo Cleaning Essentials. None of the tested products exceeded detection threshold of 95%, but taking into account the freshness of infected files (using local signatures or developer cloud) the static detection rate of about 90% can be considered satisfactory.

Read more here

 

[lowdetection]

This confirm to me to only keep EEK on my Desktop folder, and ignore the rest.

 

[Deleted member 65228]

This confirm to me to only keep EEK on my Desktop folder, and ignore the rest.

On Day 1, Emsisoft Emergency Kit managed to detect 3087/3281. Any other products listed there may have detected sample/s between 3088-3281 which Emsisoft Emergency Kit didn't. Therefore, other on-demand scanners are still important and useful!

I think that usually it is best to have 2 on-demand scanners, if I had to decide then personally I'd go with Emsisoft Emergency Kit (EEK) and HitmanPro (HMP) - quick and easy. The only thing is that both EEK and HMP have signatures from Bitdefender, but HMP also has signatures from Kaspersky and their own in-house engine so I don't see it as a problem.

 

[lowdetection]

Infact I also use Hitman Pro and Zemana on demand, is that I have a desktop folder called Applications where I have also EEK, with exiftools, pestudio and other tools, I keep it with them for a reason only "Umbra" know; but in future I may move on a USB pen dedicated for all of them, is just that many of the tools inside that folder are updated fast like FRST, so is for that reason that I keep on my Desktop.

Edit: I just checked, I have one tool of them mentioned up here and is the one from Comodo, but is not like EEK, is more similar to Process Explorer, but is from their family.
I didn't remember I have there.

Is KillSwitch.

Sorry.

 

[HarborFront]

Where's NPE?

 

[bribon77]

Well, I have Emsisoft installed. As an on-demand scanner, I have Zemana, HitmanPro, Norton Power Eraser.

 

[HarborFront]

Well, I have Emsisoft installed. As an on-demand scanner, I have Zemana, HitmanPro, Norton Power Eraser.

Yes, they should test the free on-demand HMP, NPE and Zemana as well

 

[bribon77]

Where's NPE?

Norton Power Eraser.

 

[lowdetection]

Hitman Pro is nice for the EWS, many info for that, but sometime need how to interpret that information, like high livel of entropy or other things.

 

[Deleted member 65228]

Hitman Pro is nice for the EWS, many info for that, but sometime need how to interpret that information, like high livel of entropy or other things.

Entropy is likely meaningless to most users of HitmanPro. It is to do with the randomness of data within the target file. For example, a low entropy suggests the PE is not "encrypted"/"packed" whereas a high entropy suggests the opposite. It is calculated via a mathematical equation, related to physics probably too (generally speaking).

 

[lowdetection]

Opcode, about packed, inside my Application folder there is also portex GitHub - katjahahn/PortEx: Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

But I am sure you know it.

 

[ForgottenSeer 58943]

Yes, they should test the free on-demand HMP, NPE and Zemana as well

HMP is very strong. NPE finds some tough stuff. I agree with the test in that Trend Housecall is very good, it's often one of the ONLY scanners to find zero day file-less malware and we routinely use it. I personally use HMP and ClamAV, nothing else for on-demand.

It's kind of funny how useless MBAM is these days. Even ClamAV beats it!

 

[jerzy601]

I am currently using EEK and Zemana Anti-Malware and it's enough to do everything right.

 

[Syafiq]

I'm using EEK, ZAM Portable, and HitmanPro as On Demand Scanner

 

[aragornnnn]

The days when we only had to use MBAM to clean our infected systems are over it seems

 

[woodrowbone]

Comodo doing this well!
I am very surprised

/W

 

[TairikuOkami]

Comodo and ClamAV beating MBAM? I knew, that it is bad, but not that bad. As for Windows Defender, no surprise there.
Kaspersky is a bit disappointment, but CureIt surely surprised me. And that Trend Micro HC thingy, I did not even know about it.

No need to mention Emsisoft Emergency Kit, I always recommend it as the first choice, this has only reassured me.

 

[509322]

The difference between the AVLab and AV Comparative test results is in the way the two labs collect the samples. AV Comparatives always shows Windows Defender with a much higher percentage performance. Read the differences in test methodology.

Windows Defender is improved, but it is nowhere near as good as some argue it is on the security forums and unfortunately there are people that listen to their garbage. The Windows Defender fanboys overstate its capabilities. Still, for some users, it is sufficient. For other users, no matter what they put on their system, they are going to get themselves infected eventually. It depends upon the user and the extremes. For the middle user, it is hit or miss.

Windows Defender must be supplemented.

 

[harlan4096]

Kaspersky is a bit disappointment

KVRT2015 has not been upgraded for more than 2 years, They still give support of signatures and access to the cloud, but I guess the tool got a bit obsolete, anyway still valid as We can see in some tests

 

[Deletedmessiah]

Sad to see how Malwarebytes has gone so down over the years. On other hand, good job EEK! Its performance and scan speed is like that of an online scanner, very fast.