Reply to thread

Message

<blockquote data-quote="XLR8R" data-source="post: 898841" data-attributes="member: 85385">After thinking about [USER=82260]@EndangeredPootis[/USER] post I contacted one of these AV companies, and I&#039;ve been informed that AV-Test rates the protection scores less if the AV product does not terminate the processes of certain malware/droppers immediately and instead just blocks their internet connections, rendering them useless.Some of the lower scoring products in the protection category have fallen prey to this, as these products tend to block the processes activity rather than terminating them, and complete the termination and removal process on the next system reset/reboot.The reason I have been given for such behaviour is because these vendors are slightly concerned about performance concerns or crashes/stability issues on lower spec computers arising from immediate termination of certain problematic processes and hence tend to follow a safer &quot;remove on reboot&quot; methodology.I guess, some of the tested products (e.g. eScan) really are much better than given credit for by AV-Test, because the Malware Hub results come out reasonably well for these products.In general, I remember a few years ago that an AV-Tester told me that categories/tiers do not really matter much because those are subject to perception and test conditions, what matters is if your product is good enough to score the minimum standard passing grade. Other than that, user experience will tell the story more than any test will....</blockquote>

[QUOTE="XLR8R, post: 898841, member: 85385"] After thinking about [USER=82260]@EndangeredPootis[/USER] post I contacted one of these AV companies, and I've been informed that AV-Test rates the protection scores less if the AV product does not terminate the processes of certain malware/droppers immediately and instead just blocks their internet connections, rendering them useless. Some of the lower scoring products in the protection category have fallen prey to this, as these products tend to block the processes activity rather than terminating them, and complete the termination and removal process on the next system reset/reboot. The reason I have been given for such behaviour is because these vendors are slightly concerned about performance concerns or crashes/stability issues on lower spec computers arising from immediate termination of certain problematic processes and hence tend to follow a safer "remove on reboot" methodology. I guess, some of the tested products (e.g. eScan) really are much better than given credit for by AV-Test, because the Malware Hub results come out reasonably well for these products. In general, I remember a few years ago that an AV-Tester told me that categories/tiers do not really matter much because those are subject to perception and test conditions, what matters is if your product is good enough to score the minimum standard passing grade. Other than that, user experience will tell the story more than any test will.... [/QUOTE]

Verification