It’s not uncommon for antivirus products to detect the twisted versions exactly as they did the originals. The point of this exercise is to find too-rigid signature-based detection systems. I take each sample, rename it, append nulls to change the file size, and tweak some non-executable bytes. I maintain a second set of samples, twisted versions of the main collection. Adaware started slowly removing samples the moment we opened that folder. Others wait until each sample is about to launch. Just opening the folder is enough to trigger real-time protection in many products. Our basic malware protection test starts when we open a folder containing a hand-collected and curated set of malware samples.
Even for products that get plenty of lab scores, hands-on testing lets us experience how each product handles malware. In the absence of any information from the labs, our own hands-on tests are the only proof we’ve got that an antivirus works (or doesn’t). Kaspersky’s free security suite includes all the antivirus protection of the company’s paid products, which took a perfect 10-point aggregate lab score. Our aggregate lab results algorithm, which yields a score from 0 to 10, rates these at 9.7, 9.7, and 9.1 respectively. Maybe it’s not fair to expect the maker of a free product to pay up? But all four of the labs we follow include Avast, Avira, and Microsoft Windows Defender Security Center, all of which are free. It’s true that security companies pay the labs for inclusion in testing (which also gets them detailed results).
0 kommentar(er)
