A third of anti-malware products fail to secure Vista Business Edition, Virus Bulletin reveals

Posted by   Virus Bulletin on   Aug 12, 2010

VB urges industry to work harder at quality assurance.

One third of products failed to meet the standard required for VB100 certification Virus Bulletin has revealed that, out of 54 anti-malware products tested, 19 failed to reach the standard required for VB100 certification in its recent test on Windows Vista Business Edition SP2.

Stumbling blocks for the products in this test included failure to detect a number of viruses known to be circulating in the wild and false alarms produced on clean files from major software houses including Corel, Roxio and Adobe. But alongside these issues, the test team also encountered problems with product design and stability.

"Once again we have looked at a huge range of products, and found a wide variation in performance and effectiveness. Most notable this month, though, has been the remarkable level of instability under pressure noted in many of the products - while our tests do put unusual strain on products, it is clearly important that security software should continue to function under pressure, and should not crumble in the face of heavy attack," said John Hawes, Virus Bulletin's Anti-Malware Test Director. "Flaky behaviour will certainly not instill a sense of security in users, and developers need to ensure their quality control is thorough and comprehensive, to keep their users properly protected at all times."

The review provides a wealth of data that gives insight into how the various solutions stack up against each other in a wide range of ways, including some detailed performance analysis as well as detection rates and the testing team's thoughts on the user experience.

Virus Bulletin has been testing and certifying anti-malware products for more than ten years in the VB100 certification scheme. The stringent VB100 tests pit anti-malware products against a test set of malware from the WildList - a publicly available up-to-date list of the malware that is known to be circulating on computers around the world. To earn VB100 certification, products must be able to detect 100% of the malware contained in the WildList test set and must not generate any false alarms when scanning a set of clean files.

The results of the August 2010 VB comparative review can be seen here [registration required - free of charge].

VB's cumulative RAP ('Reactive And Proactive') quadrant, which gives a quick visual reference as to products' reactive and proactive detection rates over a six-month period, is shown below:

The full Windows Vista Business Edition review, including detailed results tables, is available to Virus Bulletin subscribers here (with details on how to become a subscriber here).

A full description of the RAP testing methodology can be seen here [registration required - free of charge].

Posted on 12 August 2010 by Virus Bulletin



Latest posts:

New paper: Collector-stealer: a Russian origin credential and information extractor

In a new paper, F5 researchers Aditya K Sood and Rohit Chaturvedi present a 360 analysis of Collector-stealer, a Russian-origin credential and information extractor.

VB2021 localhost videos available on YouTube

VB has made all VB2021 localhost presentations available on the VB YouTube channel, so you can now watch - and share - any part of the conference freely and without registration.

VB2021 localhost is over, but the content is still available to view!

VB2021 localhost - VB's second virtual conference - took place last week, but you can still watch all the presentations.

VB2021 localhost call for last-minute papers

The call for last-minute papers for VB2021 localhost is now open. Submit before 20 August to have your paper considered for one of the slots reserved for 'hot' research!

New article: Run your malicious VBA macros anywhere!

Kurt Natvig explains how he recompiled malicious VBA macro code to valid harmless Python 3.x code.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.