See if your antivirus software REALLY works

MDesigner

Platinum Member
Apr 3, 2001
2,016
0
0
Having recently ditched Norton because it sucks (what other virus app has so many knowledge base entries on support.microsoft.com because of system problems??), I started researching other antivirus apps.

I realized that reviews in magazines was not going to help. I also realized using the EICAR test was not going to help (big deal.. EICAR is a file to test virus apps to make sure they work.. of course they work! but how well?). The only real way to test an antivirus app is to shove a virus in its face and see how it deals with it.

To help in my research, and for your own knowledge and peace of mind.. I'm asking that you download the file below and unzip it. It contains three trojan horses, and these are not brand spanking new either as far as I'm aware.. so if your antivirus app does not stop you from unzipping these, then you might want to consider finding something else.

http://www.samhulick.com/virii.zip

DISCLAIMER: I take no responsibility for any damage to anyone's computer as a result of downloading the file above. The instructions are clear: UNZIP ONLY. DO NOT RUN OR OPEN OR ATTEMPT TO EXAMINE ANY OF THE FILES THEREIN.

Let me know which antivirus software you use and what the results of this test were.

My personal results: (all apps were updated w/ their latest virus DB)

Bitdefender Home Edition: works great, detected all three trojans and disallowed any access to them.
avast! (free version): caught Dc61.exe, but didn't know that the other two files were viruses.
NOD32: thumbs down. didn't detect anything at all. guess it's not as good as people say it is!
UPDATE: I've been informed that NOD32 is anti-virus only, not anti-trojan. That concept seems kind of silly to me... trojans are similar to viruses, they spread & infect other computers..but sometimes they're more dangerous because they allow a 3rd party to gain control over your computer.

UPDATE:
McAfee 4.5.1 SP1: only caught kernel32.dli.. missed the other two! YIKES. And to think we run this crap here at work.

UPDATE 2/16:
Panda Titanium Antivirus 2004 and Bitdefender 7.2 seem to be pretty solid. PC cillin catches all three viruses, but it seems just the older version of the software. The newer one (now called Internet Security 2004) does NOT pick up all three.

Also, I've updated the virii.zip file.. it contains a total of seven viruses/trojans now. Panda actually missed one of them (Bitdefender still caught every single one), however, even the pretty reliable RAV antivirus online scanner missed the same one Panda missed. This is kind of bad..because normally if a virus is not picked up, but I THINK it might be dangerous, I'll use the RAV online scanner to verify. No matter how much a better interface Panda has over Bitdefender, or how much more informative it is, you can't ignore the importance of an antivirus software's ability to recognize as many viruses as possible.

Stay tuned for my review of Panda vs. Bitdefender. (other antivirus apps will not be compared because they failed my initial tests)

UPDATE 2/18:
I bought Panda Titanium Antivirus 2004. :) Bitdefender had a serious bug where its autoprotect would just stop. Not good. So Panda wins! By the way, you can get Panda Platinum 7.0 for FREE if you're an IT professional. CHECK IT OUT!
 

Abhi

Diamond Member
Sep 13, 2003
4,548
0
76
Uh... just because i unzipped it... doesnt mean its installed right :D

Just makin sure ...
 

MDesigner

Platinum Member
Apr 3, 2001
2,016
0
0
Correct. Unzipping viruses/trojans all day long won't cause any harm. Just don't run them.
 

MDesigner

Platinum Member
Apr 3, 2001
2,016
0
0
Originally posted by: gsaldivar
PC-Cillin 2002 identified & blocked this in mid-download.. :D

Wow..impressive. I wonder if it would've detected all three.. it might've rejected the zip file because it found at least just one infected file.

PC-cillin is great stuff.. too bad all they sell now is that Internet Security for $50. I won't pay for extra stuff I don't need (anti-spam, firewall, etc.). They'd be very smart to rerelease just standalone anti-virus software for $25 or so.
 

eriqesque

Senior member
Jan 4, 2002
704
0
71
Originally posted by: MDesigner
Originally posted by: gsaldivar
PC-Cillin 2002 identified & blocked this in mid-download.. :D

Wow..impressive. I wonder if it would've detected all three.. it might've rejected the zip file because it found at least just one infected file.

PC-cillin is great stuff.. too bad all they sell now is that Internet Security for $50. I won't pay for extra stuff I don't need (anti-spam, firewall, etc.). They'd be very smart to rerelease just standalone anti-virus software for $25 or so.

 

MDesigner

Platinum Member
Apr 3, 2001
2,016
0
0
gsalvidar & eriqesque: could you disable your auto protect, download the zip file, extract the files into a folder...then do a manual scan of the folder to see which viruses/trojans your software picks up on?

Thanks
 

gsaldivar

Diamond Member
Apr 30, 2001
8,691
1
0
Originally posted by: MDesigner
gsalvidar & eriqesque: could you disable your auto protect, download the zip file, extract the files into a folder...then do a manual scan of the folder to see which viruses/trojans your software picks up on?

Thanks

PC-Cillin 2002 identified 2 out of 3.

It missed the kernel32.dlI file.

 

onelin

Senior member
Dec 11, 2001
874
0
0
I downloaded the .zip with scan compressed files DISABLED, enabled it, and then opened the zip and Trend Micro Internet Security 2004 (PC Cillin) caught all 3 before it even let me open it in winrar. (winrar got a cannot open message)
 

MDesigner

Platinum Member
Apr 3, 2001
2,016
0
0
Wow, that's odd. Why would Trend Micro's older version of PC cillin not have the same virus/trojan data that their new Internet Security software does? Hmm...

Anyway, that's good to know. I've been scouring the net for reviews, and at least a couple sites agreed that Bitdefender and PC-cillin were the top two anti-virus/anti-trojan apps. Here are a few screenshots for those unfamiliar with Bitdefender.
 

Shagga

Diamond Member
Nov 9, 1999
4,421
0
76
Well, all you ppl that give Norton stick over how cr@p they are and I have never had a problem. In fact I scaned the *.zip file and this is what Norton Reported.

So I guess they get a cookie. :)
 

Robor

Elite Member
Oct 9, 1999
16,979
0
76
Originally posted by: Abhi
Norton caught 2....

Didnt catch kernel32.dli....
Same here. I'm running the 2004 Symantec Antivirus Corporate Edition.

 

rbV5

Lifer
Dec 10, 2000
12,632
0
0
AVG free results:

VIRII.ZIP:\porn.bat Could be infected BAT/HitOut
VIRII.ZIP:\Dc61.exe Trojan horse Dropper.Kifer.A
VIRII\DC61.EXE repaired
VIRII\KERNEL32.DLI Trojan horse BackDoor.Amitis.AC
VIRII\PORN.BAT Could be infected BAT/HitOut
 

BlueWeasel

Lifer
Jun 2, 2000
15,940
474
126
Damn....EZtrust AV only caught the porn.bat file. The other two make it through just fine. :(

No wonder EZtrust was running the free AV and Firewall deal a few months ago. :D
 

glugglug

Diamond Member
Jun 9, 2002
5,340
1
81
Originally posted by: MDesigner
Correct. Unzipping viruses/trojans all day long won't cause any harm. Just don't run them.

Technically correct, but in practice it may seem otherwise due to the wonderfully secure default windows settings. It is possible to construct a file with code that will get executed merely due to opening the containing folder by the wonderful Windows Explorer preview pane implementation.
 

onelin

Senior member
Dec 11, 2001
874
0
0
most antivirus programs are subscription based, maybe he doesn't have the latest definitions. auto-update is gone on older vers after a year (which I think is crappy, but norton is the same only w/ bugging you for resubscription with a max of "remind me in 1 day" wait times.
 

n7

Elite Member
Jan 4, 2004
21,303
4
81
Norton auto-caught & killed two before they even finished dl-ing, but totally missed the kernel32.dl one.
 

MDesigner

Platinum Member
Apr 3, 2001
2,016
0
0
OK, I tried out Panda (now known as Titanium Antivirus 2004)... pretty slick! But I can't understand all the bad reviews on CNet and Download.com, saying it's unstable. It caught all three viruses on a manual scan, HOWEVER, Panda's autoprotect failed to pick up kernel32.dli. Why? Because the extension DLI was not on Panda's auto protect list of extensions. That's pretty weak. Any file I click on should be analyzed. And you can't add * to the extension list to scan all extensions. Bitdefender will scan any file you try to interact with, which is nice. But I suppose if the extension is something stupid like DLI, then it doesn't really matter too much, right?

At this point I'd say Bitdefender & Panda are pretty solid.
 

NEVERwinter

Senior member
Dec 24, 2001
766
0
71
MDesigner, you're right... Bitdefender caught all three. Now I know that I made a good choice.
btw, anyone tried that file with F-Secure Antivirus? I heard it's pretty powerful with its double AV-engine (Kaspersky and something else)