App Review League of Antivirus - AVG AntiVirus FREE 20.8.3147 (build 20.8.5684.602) vs Malicious URLs, Phishing URLs, Malware Samples and LoAV SCORE

[JoeN]

Content source

https://youtu.be/yusmmw7ewvg

AVG AntiVirus FREE 20.8.3147 (build 20.8.5684.602) vs Malicious URLs, Phishing URLs, Malware Samples and LoAV SCORE



Strange thing, score is different than Avast, when they share the same engine. AVG was tested some time after Avast.

 

[Andy Ful]

It is not strange at all. Most of the AVs you are testing, have almost the same detection in the wild. Different results follow mainly from the testing procedure. On average, there are over 300000 new malware samples a day. Your test is like estimating the weather by inspecting a very small area of the sky. You would have more correct results by doing such a test 10 times on totally different samples. See on these threads:

AV-Comparatives - Randomness in the AV Labs testing.

Let's consider the example of the initial pule of 30000 sufficiently different malware variants in the wild and the particular AV which failed to detect 100 of them. Next, we make for the above results a trial to choose 380 samples from these 30000 and calculate the probabilities for finding in...

malwaretips.com

MRG Effitas - MRG Effitas Assessment & Certification – Q2 2020

Mrg Effitas tests the business AV versions that usually have activated some Advanced Threat Protection features. Some AVs use the custom configuration in these tests (Avast, Avira, CrowdStrike, Eset, Microsoft, Symantec). Awarded AVs: • Avast Business Antivirus • Bitdefender Endpoint Security •...

malwaretips.com

Due to the enormous number of new malware samples a day and minimal differences between AVs, one particular test cannot say much about real AV detection.

Anyway, if you will do such tests for several AVs we can use statistics to calculate the average protection of Avs. Keep going with AV testing.

 

[Andy Ful]

@JoeN,
I noticed that you use phishing links that point to phishing domains. Unfortunately, some AVs often do not block domains but only malicious content (scripts, files). Many phishing websites cannot infect the user until he/she sign in or click something malicious, and then the AV will block only the malicious script or another malicious file in the subdomain.
One example of such AV is Windows Defender with Network Protection. Of course, when the malicious content is loaded when rendering the website, the domain will be blocked too.
See for example:
https://malwaretips.com/threads/upd...ison-malwares-and-phishings.80915/post-764253

Another thing is that close to 90% of malicious URLs are not active after one day, for example:
"In fact, over a 60-day period, Akamai observed more than 2,064,053,300 unique domains commonly associated with malicious activity. Of those, 89% had a lifespan of less than 24 hours, and 94% had a lifespan of less than three days."

https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/soti-security-phishing-baiting-the-hook-report-2019.pdf

Post edited.

 

[JoeN]

@Andy Ful thanks for all the informations! That's why I try to do within 24h. But next day most phishing links was dead, that's why I replaced all of them with fresh ones. Thanks for all support. This is my first steps after long time of suspension.

 

[Andy Ful]

You can also ask the staff to join the Malware Hub team.