Advice Request do you believe this AV test?

[Brie]

do you believe that this test is accurate?

 

[Deleted member 65228]

Nope I don't trust it

 

[tim one]

Same here, malware testing is just a tricky business....

 

[upnorth]

I only trust my mom and she didn't write that list.

 

[Deleted member 65228]

I think I would rather trust a cat to give me alien powers so I can fly to space and survive without breathing so I don't require an oxygen tank while making my skin bullet-proof, fire-proof, water-proof, rock-proof, and anything else-proof whilst making me live for eternity thanks to a hardened heart which regrows the cells automatically

And that isn't going to happen. So that pretty much explains how much I trust that test

 

[Peter2150]

I think I would rather trust a cat to give me alien powers so I can fly to space and survive without breathing so I don't require an oxygen tank while making my skin bullet-proof, fire-proof, water-proof, rock-proof, and anything else-proof whilst making me live for eternity thanks to a hardened heart which regrows the cells automatically

And that isn't going to happen. So that pretty much explains how much I trust that test

Totally agree. I don't waste the time to even look at them

 

[TairikuOkami]

The percentage seems too high for zero day malware, but considering the individual scores and the top dogs, it is looks realistic. I will bookmark it, just in case.

 

[amico81]

clam with higher detection than gdata or trendmicro???
I have nothing to add...just LOL

 

[212eta]

Shadoserver.org has been around for many years.
See some old Wilders Threads:

www.wilderssecurity.com/threads/shadowserver-yearly-zero-day-stats.203173/

www.wilderssecurity.com/threads/strange-results.215163/#post-1281708'

 

[Brie]

clam with higher detection than gdata or trendmicro???
I have nothing to add...just LOL

clam has a high detection rate because it has a lot of false positives.

to those of you who don't believe it, why not?

 

[Deleted member 65228]

to those of you who don't believe it, why not?

1. Haven't heard of them before
2. Not much information on their testing methadology
3. Not much information about the actual samples (e.g. sources?)
4. Not much information at all except those detection ratio charts
5. None of it is presented in a "clear" way, I cannot even look at it without straining my eyes and actually using my brain
6. Know nothing about them

I have a small brain so I need to be able to understand a chart when I see one whilst using the bare minimal effort. That as well.

 

[amico81]

I miss the test procedures, detailed anaylses, transparency, certificates....all things for a clear test result.

a chart with numbers is doing in a few seconds

 

[TairikuOkami]

These charts represent the testing that was completed in the current calendar day. The re-test values are the continued retesting of the binaries over a single day with the vendor being updated prior to each tun. Each vendor can run anywhere from ten times to over a hundred depending on the quantity of binaries and the capability of the scanner.

There has been a lot of discussion on how well each vendor does in a 'zero-day' situation, and that our stats seem to be higher than the industry norm. To better understand why these statistics show what they do, we have to look back to the sources of the binaries. Since August of 2007, we have seen a very large increase of dropper style malware being propagated. The detection rate for these types of malware (mostly trojans), is not as good as the malware that they eventually download and install. Once a system has been infected and controlled, a more reliable and stable binary is loaded. These binaries are detected at a much higher percent than the other binaries that we see because they are in many case nothing new to the Anti-Virus vendors. This trend is more clearly seen by looking at our source table and because the majority of the binaries are coming from the sandboxing process means that we are receiving the greatest amount of malware from the malware samples themselves. These in turn are all fed back into the Anti-Virus testing systems and reset to the sandbox systems.

If and when this trend changes again, the charts will reflect those new directions the malware authors are taking the infection vectors.

It seems, that the lastest test results are from January 2017.

Shadowserver Foundation - AV - Viruses

 

[Ink]

Some contradicting statements below.

Real world experience is far better than experimenting with samples that may no longer be relevant.

All these public and private "Security/AV Testing Laboratories" show are results and they may be able to demonstrate the capabilities of certain AV technologies, but without any transparency, nothing can be validated.

Don't believe everything you read, try things for yourself and use what you're more comfortable with.

As previously mentioned, they have been around for many year. And with that said, there's nothing to suggest that AV Testing cannot be trusted, just because you haven't seen or heard of them before.

. Not much information at all except those detection ratio charts

Don't forget the most important one.. the preferred AV gets below 98.9% score, the fanboys will trash the place.

 

[Mahesh Sudula]

ALL THESE LAB RESULTS ARE INCLINED TO TESTED SAMPLES..and some may be commisioned ..myself can easily say K7 is not that good...and their all components range from average and i have a 20 yrs license of it..but still left it to the garbage...THEY ONLY HAVE VIRUS LAB AT CHENNAI (TAMIL NADU)..and all the detections and threat response is only from that side..EVEN in that case..take it with a pinch of salt....
most of these lab results are just FOILED AND MONEY -DEPENDENT

 

[MeltdownEnemy]

Only if the testers of other pages were sincere like the boys here, then I would believe. meanwhile not, because that could be a marketing strategy, for sure someone are receiving some benefit in favor of the mark businessman and his proposal. only are statistical html charts, without real time videotest.

 

[Viper007]

wont even bother looking, just go look at reviews and malware hub often and then decide for your self as some that may score low in some tests are actually above most in the real world.

 

[Deleted member 65228]

wont even bother looking, just go look at reviews and malware hub often and then decide for your self as some that may score low in some tests are actually above most in the real world.

The samples may not always be malicious though, and the way the testing is done can affect the results. For example, some security solutions will wait until a sample is ran from a specific folder (e.g. Downloads) or has been executed by a browser process itself (to indicate it's from an online source instead of local, e.g. having been moved via USB) and all of this can affect between monitoring, monitoring scope, internal flag algorithms, and the sample being flagged or not in the end.

I've seen some security software engineers mention things like this before regarding exploit/behavioural prevention targeting new zero-days downloaded from an online source, I recall it was something to do with a sample being flagged when ran via the browser after a download in the environment and then the same sample not being flagged when ran outside of the browser after being copied across to the environment.

Which products work in this way I cannot say because I do not know.

 

[omidomi]

where is Kaspersky

 

[Deleted member 65228]

where is Kaspersky

You already know where it is! It's in Russia!

Hahahahaha