Battle Planned: Real-world Test of Trend Micro, ZoneAlarm, Eset and Webroot

[Andrew3000]

@SeriousHoax or @Andrew3000 Are you guys able to help with the test? Or maybe @silversurfer ?

I would like to do that (especially to prove how green W is a faulty product). In Italy, these days are holiday, and I am out of town for a few days

 

[Trident]

By going away I didn't mean to imply anything about the discussion, but just that I have a flight out later today. Also, about your test- I wouldn't bother overly taking time with how (or where) the malware is run, because the cream will rise to the top in any scenario.

Oh well, enjoy your flight and guessing(?) holidays.

I am not bothered at all, neither I will start decoding packets from Wireshark. Just proving a point.

A good anti-malware protects the system one way or another. It could be with sandboxing, could be with reputation, could be with containment (McAfee DAC that can restrict your system heavily comes to my mind here), static analysis and whatnot.

I do not agree that anti-malware that whitelists absolutely everything trusted from both behavioural monitoring and scans, and on top of that has no AV definitions but just hash-based protection is amazing.
I also don’t agree that anti-malware according to other people’s words, leaving malware active for hours before performing “rollback” is great.

We can beat around the bush/beat chest all day.

Furthermore, as stated many times, the default-deny of webroot only covers executables, not even MSI files. So it’s a child’s play.

 

[Sandbox Breaker]

@SeriousHoax or @Andrew3000 Are you guys able to help with the test? Or maybe @silversurfer ?

I've always been here lol.

 

[Sandbox Breaker]

Oh well, enjoy your flight and guessing(?) holidays.

I am not bothered at all, neither I will start decoding packets from Wireshark. Just proving a point.

A good anti-malware protects the system one way or another. It could be with sandboxing, could be with reputation, could be with containment (McAfee DAC that can restrict your system heavily comes to my mind here), static analysis and whatnot.

I do not agree that anti-malware that whitelists absolutely everything trusted from both behavioural monitoring and scans, and on top of that has no AV definitions but just hash-based protection is amazing.
I also don’t agree that anti-malware according to other people’s words, leaving malware active for hours before performing “rollback” is great.

We can beat around the bush/beat chest all day.

Furthermore, as stated many times, the default-deny of webroot only covers executables, not even MSI files. So it’s a child’s play.

Webroot Denys Only exes. That's disgusting. Eww lol

 

[Harputlu]

Don’t worry, it may not be necessary, I am looking for ransomware samples as well. When the desktop wallpaper is changed, that is a clear sign, isn’t it?

I'm sorry, but you are only writing to praise the zonealarm program. In fact, zonealarm would probably have come first in the test. When 99 out of 100 posts were zonealarm, I wondered if I was corresponding with a PR person. And I don't trust your test.

 

[silversurfer]

@SeriousHoax or @Andrew3000 Are you guys able to help with the test? Or maybe @silversurfer ?

I am sorry, testing malware samples is impossible for me during summer months... no matter with VM or on a secured testing machine.
But feel free asking me sometime later this year in case of another AVs battle

 

[Trident]

I'm sorry, but you are only writing to praise the zonealarm program. In fact, zonealarm would probably have come first in the test. When 99 out of 100 posts were zonealarm, I wondered if I was corresponding with a PR person. And I don't trust your test.

Who you trust and don’t trust is your personal choice and is in no way affecting me, and what I will do around this forum.

1. I am rarely praising ZoneAlarm, I am praising CP Harmony Endpoint.
2. Until one point, I was saying ZoneAlarm is not recommended. If you didn’t see these posts, it is not my fault. I identified a bunch of design errors in CP Harmony and ZoneAlarm, which were fixed thanks to my reporting. Unlike many people who go on forums just to rant.
3. I am not simply saying “Check Point is great” and leaving it there. I always post blog posts, tests, screenshots and explain the technologies in depth.
4. If you are aware of any other home AV that takes the files from the user, emulates them and then passes them, please enlighten us now. We will start praising that. You got 10 minutes to tell me which is the other AV with business-grade emulation. Go.

 

[Harputlu]

Who you trust and don’t trust is your personal choice and is in no way affecting me, and what I will do around this forum.

1. I am rarely praising ZoneAlarm, I am praising CP Harmony Endpoint.
2. Until one point, I was saying ZoneAlarm is not recommended. If you didn’t see these posts, it is not my fault. I identified a bunch of design errors in CP Harmony and ZoneAlarm, which were fixed thanks to my reporting. Unlike many people who go on forums just to rant.
3. I am not simply saying “Check Point is great” and leaving it there. I always post blog posts, tests, screenshots and explain the technologies in depth.
4. If you are aware of any other home AV that takes the files from the user, emulates them and then passes them, please enlighten us now. We will start praising that. You got 10 minutes to tell me which is the other AV with business-grade emulation. Go.

You have said in many places that zonealarm is a very good program and that it uses many features of checkpoint. In my opinion there are much better programs than zonealarm: Kaspersky (uses zonealarm), Sophos (uses zonealarm), Eset, Bitdefender (without Bitdefender there would not be half of the antivirus companies on the market) Norton, avast

First, let's see Zonealarm's participation in the tests

Most importantly, Israeli companies are so trustworthy that I should buy it right now. It's strange to trust zonealarm and not Kaspersky

 

[Trident]

You have said in many places that zonealarm is a very good program and that it uses many features of checkpoint. In my opinion there are much better programs than zonealarm: Kaspersky (uses zonealarm), Sophos (uses zonealarm), Eset, Bitdefender (without Bitdefender there would not be half of the antivirus companies on the market) Norton, avast

First, let's see Zonealarm's participation in the tests

I’ve never said “very good” because “very good” is not even the way I talk.

I explain the way it works. Whether it is “very good” is users’ personal opinion from there onwards?

Did I say that the other products mentioned in your list are not “good”?
I was praising the BD memory scanner recently.

 

[cartaphilus]

You do know that there are easier ways to cause inhumane pain without evoking webroot as a comparison against other tools? Thank god you didn't add comodo into that mix.

 

[cartaphilus]

You have said in many places that zonealarm is a very good program and that it uses many features of checkpoint. In my opinion there are much better programs than zonealarm: Kaspersky (uses zonealarm), Sophos (uses zonealarm), Eset, Bitdefender (without Bitdefender there would not be half of the antivirus companies on the market) Norton, avast

First, let's see Zonealarm's participation in the tests

Most importantly, Israeli companies are so trustworthy that I should buy it right now. It's strange to trust zonealarm and not Kaspersky

Meh I don't trust my own country so why should I trust Israel? That being said, based on the way things escalated and what will happen if the bad guys win, I am more against Kaspersky than I am against any other AV.

 

[TuxTalk]

The funny thing is, ZoneAlarm is American company now ( checkpoint ) but please leave the war out of this topic.

 

[cartaphilus]

The funny thing is, ZoneAlarm is American company now ( checkpoint ) but please leave the war out of this topic.

This whole topic is a warzone. Or is it a mine field?

I like checkpoint, I use checkpoint. Would I use it on some very sensitive system? probably not. Will I use it in my house? definately yes.

 

[TuxTalk]

This whole topic is a warzone. Or is it a mine field?

I like checkpoint, I use checkpoint. Would I use it on some very sensitive system? probably not. Will I use it in my house? definately yes.

Checkpoint US company

 

[Divine_Barakah]

Checkpoint US company

Yea that makes it better.

 

[BSONE]

I remember buying a few cheap Webroot licences from Newegg or Amazon about 10 years ago. It had a very basic UI back then with a green icon on the taskbar. It saved me once when I clicked on a double extesion file.

 

[TuxTalk]

Yea that makes it better.

Better than Russian

 

[Sorrento]

Do we know the results of the tests yet? Or have I missed something?

 

[Trident]

Do we know the results of the tests yet? Or have I missed something?

Unfortunately I tested ZoneAlarm and tested Webroot. On Webroot my PC started being extremely slow and sluggish and died. I then tried to install on Parallels for Mac, but AVs don’t wanna install on this environment it seems. Webroot blocked all phishing samples, on the malware, I couldn’t inspect the system. The rest, couldn’t even install.

I still haven’t looked at this laptop and what happened, probable the SSD.

 

[Sorrento]

Got you - thanks - Rome wasn't built in a day ...