Ian
Stole All the Forum Stars
Good things come to those who wait ...
Posts: 2907
|
 |
Re: Maybe of some interest!
« Reply #1 on: Nov 3rd, 2002, 3:14pm » |
 Quote  Modify
|
It's a question without a fixed answer. Many of the tests are 'skewed' (if not actually outright 'biased') to show one thing or another. The PCFlank one discussed in this forum a few months ago didn't even include BOClean - talk about missing out one of the biggest, most well-established AT programs! Also, any test that claims three or four generic AVs are better than BOClean, TDS, TH et al must be viewed as suspicious.
I doubt that any of the tests use all Trojans from the wild in their group (it's not as many as the >5,000 signature figures claimed by some AT programs - more like half that). One test used a set of 280 Trojans 'from the wild' (a phrase used more to legitimise any security test than carry any real meaning). This is only about 10% of the total number. In that test, TH v1 (very old now) scored about 1%. Give the size of the TH database at that time, which probably only covered about 50% of all Trojans two years ago, the number picked by the testers easily fitted into the remaining 50%.
It's very easy to 'engineer' the results of tests by selecting a group of Trojans that will only be found 100% by one program. I'm afraid the search for a truly accurate, exhaustive group test for AT, AV of other security software will go on and on, with some users always unhappy about the apparent position of 'their' chosen program.
Let us know when you find a test that uses >2000 actual Trojans (and all their variants, so the number could be 7-10,000 in total), with memory-resident detection of accessing the Trojan file, as well as scanning the PCs drives, and that includes all programs claiming to detect Trojans. I haven't seen a site like that yet. 
|
Mischel Internet Security Forum
Reply
Notify of replies
Send Topic
Print
Author
Remove
IP Logged
Search
Members
Login
Register