Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 972479" data-attributes="member: 32260">We may skip average users here. They do not care about AV tests. They will use any AV suggested by someone who is accepted by them as a more experienced user.These tests do not provide people with a false sense of security, because the awarded AVs are as good (in practice) as the best AVs tested on Malware Hub. This is not in contradiction with MH results. The MH samples include both the samples used as initial infection vectors and also many samples that are payloads (delivered later in the infection chain). Such samples are relevant in Enterprises - payloads can be directly used to infect (clean) computers in the network via lateral movement. Furthermore, many samples on MH come from targeted attacks (rarely used against home users).The Real-World AV-Comparatives Consumer tests are focused on the samples that can be initial vectors of infection against home users, because there is no lateral movement in the home environment. The payloads and malware from targeted attacks are not common in these tests.So MH and Consumers Real-World tests are relevant for different environments and the results cannot be directly compared.The Real-World tests include malicious URLs and executable files that were downloaded from these URLs. There are several definitions of executable files. For example:On Fileinfo.com we can see near 200 such executable files:[URL unfurl=&quot;true&quot;]https://fileinfo.com/filetypes/executable[/URL]It is not clear which files are treated by AV-Comparatives as executable files, but it is very probable that this can be any file that can be downloaded/run via malicious URL (also scripts).</blockquote>

[QUOTE="Andy Ful, post: 972479, member: 32260"] We may skip average users here. They do not care about AV tests. They will use any AV suggested by someone who is accepted by them as a more experienced user. These tests do not provide people with a false sense of security, because the awarded AVs are as good (in practice) as the best AVs tested on Malware Hub.[B] This is not in contradiction with MH results. [/B] The MH samples include both the samples used as initial infection vectors and also many samples that are payloads (delivered later in the infection chain). Such samples are relevant in Enterprises - payloads can be directly used to infect (clean) computers in the network via lateral movement. Furthermore, many samples on MH come from targeted attacks (rarely used against home users). The Real-World AV-Comparatives Consumer tests are focused on the samples that can be initial vectors of infection against home users, because there is no lateral movement in the home environment. The payloads and malware from targeted attacks are not common in these tests. [B]So MH and Consumers Real-World tests are relevant for different environments and the results cannot be directly compared.[/B] The Real-World tests include malicious URLs and executable files that were downloaded from these URLs. There are several definitions of executable files. For example: On Fileinfo.com we can see near 200 such executable files: [URL unfurl="true"]https://fileinfo.com/filetypes/executable[/URL] It is not clear which files are treated by AV-Comparatives as executable files, but it is very probable that this can be any file that can be downloaded/run via malicious URL (also scripts). [/QUOTE]

Verification