App Review Avast Free (MAXIMUM) Lockdown vs 1,000 Malware Samples

[DJ Panda]

Enjoy! I reccomend you skip to the end as it might be pretty boring having me test samples one by one.

For anyone curious of the tweaks I did majority of them can be found here. How to setup Avast Internet Security 2016 for Maximum Protection (Guide)

 

[Solarlynx]

Thanks a lot!

Please next time think about changing this weird sounds for some background music.

 

[DJ Panda]

I would love to show @Jack some appreciating. Without his setup I think Avast's execution results may not have been as good.

@Solarlynx I will try not really good at video editing.

 

[Logethica]

I enjoyed your video
Despite my knowing why AV testers generally perform tests with the basic/default settings of each AV I would genuinely like to see more vids similar to yours that test a soft using its max settings.
IMO all industry AV testing labs should perform 2 tests (if they do not already) ,one with AVs on default and another with AVs on max.I would be very interested to see not only the difference between competing AVs using both tests,but also the differing test scores pertaining to each AV specifically.
It doesn't seem fair to me that a hypothetical AV that is say 5th best at BOTH default & Max settings could be rated higher than a competing AV that is say 7th on default settings but 2nd on max settings.I would prefer to have ALL of the info about an AVs possible protection capabilities,rather than a glorified overview that is aimed at those without the ability to open the UI of the product that they have selected.
Good job,mate...I hope that you make more vids

 

[Azure]

Next time if you're gonna test hardened mode. Disable your connection before executing the malware, then enable your connection and execute them again. Based on the test by @Online_Sword , the malware will be allowed.

 

[DJ Panda]

Next time if you're gonna test hardened mode. Disable your connection before executing the malware, then enable your connection and execute them again. Based on the test by @Online_Sword , the malware will be allowed.

Why would I want to disable connection? Wouldn't that essentially make hardened mode useless? Its called "Maximum Lock-down" for a reason.

 

[Azure]

Apparently if you enable hardened mode, deepscreen gets disabled

About DeepScreen/Hardened Mode
"The two features share some “overlapping” functions and therefore there is no reason to turn them both on at the same time (if you do, the Hardened Mode will always prevail over the DeepScreen)."

 

[DJ Panda]

Apparently if you enable hardened mode, deepscreen gets disabled

About DeepScreen/Hardened Mode
"The two features share some “overlapping” functions and therefore there is no reason to turn them both on at the same time (if you do, the Hardened Mode will always prevail over the DeepScreen)."

There are no conflicts. If they overlap one might have some detection that the other doesn't.

 

[Azure]

Why would I want to disable connection? Wouldn't that essentially make hardened mode useless? Its called "Maximum Lock-down" for a reason.

If you disable your connection and execute malware, then hardened mode will not protect you. That's correct.

But the issue is what happens after you re-enable your connection. Apparently if you execute the malware again, hardened mode will not stop it.

 

[Alkajak]

Why would I want to disable connection? Wouldn't that essentially make hardened mode useless? Its called "Maximum Lock-down" for a reason.

The idea would be to test the product in a worst case scenario, ie. no network connection. Not as easy to prevent/clean and more accurate in a tough spot.

 

[DJ Panda]

If you disable your connection and execute malware, then hardened mode will not protect you. That's correct.

But the issue is what happens after you re-enable your connection. Apparently if you execute the malware again, hardened mode will not stop it.

So why should I do that..? That just makes Avast worse..

@Modal Soul looking at other video reviews internet connection was enabled for those tests.

 

[Solarlynx]

@Solarlynx I will try not really good at video editing.

Anyway thanks a lot! I'm glad to see Avast is that really good!

 

[XhenEd]

So why should I do that..? That just makes Avast worse..

You're doing everyone and Avast team a favor to do that because you'll be exposing a bug if there is one.

And the scenario is a "real-world" test. Imagine losing your internet connection, then re-connected, if the bug is really there, then you're doomed against the malware.

 

[motox781]

deleted

 

[Evjl's Rain]

I think the problem with internet connection on/off is caused by Transient caching. If we disable it, we might solve the problem. not so sure
I always disable transisent caching as it uses cpu and hdd excessively

 

[DardiM]

Enjoy! I reccomend you skip to the end as it might be pretty boring having me test samples one by one.
For anyone curious of the tweaks I did majority of them can be found here. How to setup Avast Internet Security 2016 for Maximum Protection (Guide)

Have you got a link to download this 1000 samples ? I would like test KTS with my personal settings
Is this the sample pack use by Voodoo shield dev ?
Video Review - 1,000 Malware Sample Pre-Execution Efficacy Test - Malware Test

 

[DJ Panda]

Have you got a link to download this 1000 samples ? I would like test KTS with my personal settings
Is this the sample pack use by Voodoo shield dev ?
Video Review - 1,000 Malware Sample Pre-Execution Efficacy Test - Malware Test

Yes they are the same samples but I am going to make sure with staff and the vopdosheild support that I alloud to give you the samples first.

 

[DJ Panda]

Just got word back here is what they said..

"Sure, that is great with me. Also have them download their own malware packs and test the hell out of VS… and post their findings!


Also, keep in mind, all software was tested in their default settings… simply because the absolute vast majority of users run with all default settings.



If they are going to test VS, they might need to disable the parent process feature, depending on how they test. If so, they will need a VS Pro license.



If any of them needs a license, or if you do, just have them email me. Thank you!"

 

[DardiM]

Just got word back here is what they said..

"Sure, that is great with me. Also have them download their own malware packs and test the hell out of VS… and post their findings!
Also, keep in mind, all software was tested in their default settings… simply because the absolute vast majority of users run with all default settings.
If they are going to test VS, they might need to disable the parent process feature, depending on how they test. If so, they will need a VS Pro license.
If any of them needs a license, or if you do, just have them email me. Thank you!"

I'm really impressed by the 100 % (even if these are old samples). But I can't stop asking myself one thing :

From VoodooShield (on their youtube)
"We did have to make some adjustments to VoodooShield so that it would act more like a traditional antivirus software as opposed to an application whitelister, and all of the adjustments are shown at the beginning of the VoodooShield test"

Then What about "Also, keep in mind, all software was tested in their default settings… simply because the absolute vast majority of users run with all default settings" ?!

...
IMO all industry AV testing labs should perform 2 tests (if they do not already) ,one with AVs on default and another with AVs on max.I would be very interested to see not only the difference between competing AVs using both tests,but also the differing test scores pertaining to each AV specifically.
It doesn't seem fair to me that a hypothetical AV that is say 5th best at BOTH default & Max settings could be rated higher than a competing AV that is say 7th on default settings but 2nd on max settings.I would prefer to have ALL of the info about an AVs possible protection capabilities,rather than a glorified overview that is aimed at those without the ability to open the UI of the product that they have selected.
Good job,mate...I hope that you make more vids

I Completely Totally Entirely Fully Agree

Nice video, keep the good job
65% from their test, 97 % with your setting !
You love Avast, and I'm sure Avast love you

 

[Logethica]

Would you have any interest in making a video that tests Avast's new "CyberCapture" efficacy by downloading multiple,specific malware samples directly from the internet (maybe using a VM)?
Even if you have no interest in performing such a test I would still be very interested in watching any future video's that you make

On a different note (but still concerning Avast), I am aware that some people have shown reluctance to Install the Free version of Avast Antivirus due to occasional pop ups advertising the Paid version...
I have found that by either selecting an "Ask" permission for (or even killing) the "Avast Offer Installation Tool" service through your Firewall that these ads no longer appear.