Anti-Virus and "Security" Products

Courtesy of the alt.comp.virus newsgroup participants.
(These "anti-malware" pages are the result of a continuing cooperative effort.)

Translated versions available: en Français, in het Nederlands and Deutsch

Anti-Virus Main Menu
Main Menu

Help! I think I have a virus!       A.C.V Reference Desk
Introduction:

This page is intended to provide an accurate but brief overview of recommended products that (try to) prevent and/or detect the infection of computers by various types of malware. Also included are some PC security related products and "infection" cleanup/repair utilities. Referenced below are five categories of software with brief details. Whilst this information is presented primarily to assist computer novices, some of the necessary information included herein just isn't suited for brevity and/or simplicity.

The five categories of software (some with linked descriptions) included on this page are listed below:

  1. Virus-specific Anti-Virus Software (*)
  2. Generic Defense Products
  3. Malware / Trojan / Spyware Removers
  4. Firewalls / Filters
  5. Misc. Repair Utilities
(*) Please be advised that using any virus-specific anti-virus software is better for most people than using none at all these days. That said, anti-virus software is inherently reactionary and can only "protect" against what it already knows about (hence the need to keep it frequently updated). Anti-Virus software can and should probably be a part of your overall defense strategy. However, it should not be placed above the zealous practice of Safe Hex.

 
Virus-specific Anti-Virus Software
 
Product Web Site on-access scanner Details
AntiVir® PE Yes free for personal use
avast! (Home Edition) Yes free home edition
BitDefender No (free version) free edition - v7
Dr. Web Yes

same virus database can be used across different platforms

F-Prot for DOS No free for personal use
F-Prot for Windows Yes low price - light on system resourses
F-Secure Yes combined antivirus and software firewall solution
Grisoft AVG Yes free for home users
Kaspersky Antivirus Yes exceptional detection rates - expensive
McAfee VirusScan Yes a few product options and bundles
NOD (Eset) Yes very good virus detection rates - light on system resourses
Norman Virus Control Yes includes Norman’s SandBox technology
Norton Antivirus Yes assortment of product options
Panda Software Yes assortment of product options
Sophos Antivirus Yes primarily a corporate anti-virus solution
Trend PC-cillin Yes assortment of product options

Detailed independent (comparative) scanner reviews and test results (hardcore details)

Note: Please be careful how you interpret anti-virus software test results. You must really look at everything, understand what it is you're looking at and how it relates to your needs. It isn't as simple as "scanner A is better than the rest because it scored 100% in this (whatever) test..."

It is also very important to understand the terminology. For example: ITW means In The Wild; which means malware actually reported to be "out there" in circulation... and even that does not necessarily mean what you might think it *should* mean(?!!)...

Confusing? It all basically boils down to choosing a good product that meets your specific needs. Consider this; if you need hand-holding with some of the more detailed computer related tasks, then responsive and helpful product support is most likely going to be a priority. Please don't be misled by a bunch of impressive looking numbers interpreted out of context.

It's important not to place too much emphasis on VB100% detection rates (linked below) when making a purchasing decision. For instance, the fact that a product is given VB 100% awards only means that the particular product and platform tested detected all of the viruses considered as being "In The Wild". It does not mean that a product that did not detect 100% is useless, as it may have, for instance, only missed 1 virus embedded as an OLE object in a compressed file. The award is a good indication that a vendor is keeping up-to-date against the WildList when products were submitted for testing, but as you will see on these pages, it is not the only factor that should be considered. You should also remember that the result posted on the website is a summary, and without seeing the full test results and reading the testing methods, does not provide a comprehensive picture.

 
Online Anti-Virus Scanners
This option should be considered as a last resort. Online scanning of entire drives usually requires the enabling of insecure browser settings, and it is human nature to forget to restore safer settings afterward. Additionally, it is unlikely that online scanners will be able to clean infected files that are in use. However, some single file (upload) scanners do not require insecure browser settings and can be very useful for "second opinion" scans of downloaded or suspect files.

Product Web Site scan type details
BitDefender drives  
ClamAV files (Open source anti-virus toolkit for UNIX)
DrWeb on-line files  
F-Secure drives (Requires IE, ActiveX and JavaScript)
Kaspersky Anti-Virus Services files (KAV Anti-Virus)
McAfee drives (subscription based)
McAfee - AVERT WebImmune files (requires scripting and subscription)
Panda Software drives  
PcPitStop drives (based on Panda Software)
Symantec drives (security and anti-virus scans available)
TrendMicro drives  
VirusTotal files (uses several anti-virus engines)
 
Generic Defense Products
 
Product Web Site  details
eSafe (Aladdin)   gateway-based, integrated proactive content security solution and service
Invircible (NetZ) generic virus protection system
 
Malware / Trojan / Spyware Removers
When reviewing or evaluating Trojan specific products, please note the following:

1. There may be some Trojans that Trojan specific scanners will detect that the best anti-virus scanners do not. However, it is wise to base the choice of product(s) to use on quality independent tests rather than on computer magazine editor tests.

2. Some Trojan specific scanners will delete files they find as infected. Considering the possibility of false alarms, users are advised to change the initial setting made by the vendor and set the scanner to log scan results at first.

Product Web Site  details
Ad-Aware protection from known Data-mining, aggressive advertising, etc.
BOClean protects against instant-connect and polymorphic trojans such as Netbus and Sub7
The Cleaner Trojan Detection and Removal System
SpyBot   Spybot - Search & Destroy can detect and remove spyware of different kinds
Spyware Terminator combination of real-time antispyware protection and alerts
Tauscan   Trojan Horse detection and removal engine
 
Firewalls / Filters
 
Product Web Site hardware / software details
Kerio Personal Firewall Software fairly simple to use
Tiny Personal Firewall Software SNORT Compatibility
ZoneAlarm Software fairly simple to use - free version available
 
Misc. Repair Utilities
 
Product Web Site  details
FIX-CIH (Gibson Research) CIH Recovery
IVINIT.EXE (NetZ) BSV Removal
ResQ Utilites (NetZ) HDD problems
SubSeven Removal (HackFix) Backdoor.G Removal 

© Claymania Creations 2001 - 2010. All rights reserved.

Updated: December 7, 2004