microsoft

OneCare places 16th in antivirus test, 13th in spyware.

HappyAndyK   via Arstechnica on 06 September 2008 - 09:56 · 51 comments & 15041 views

Advertisement (Why?)
Virus Bulletin this month released the results of a major comparative of the latest security products, covering a range of metrics. These include detection rates over various types of malware, false positive rates, scanning speed, proactive detection, and response times to outbreaks.

Taking a look at the first one, detection rates, it's clear that a beta version of GDATA's AVK 2009 (which uses the Avast and BitDefender scan engines) took first place for both malware (measured against 1,164,662 samples) as well as ad- and spyware (94,291 samples). Avira's Premium Security Suite 2008 was second for malware, F-Secure 2009 was second in ad- and spyware, and Secure Computing's Webwasher gateway product came third in both categories.

The most interesting data to emerge from this measurement (4 week span) was that the 2009 version of Norton topped the table with an impressive 6,202 incremental micro-updates, issued several times per hour, while Kaspersky came a distant second with a mere 696. Half of the 34 products tested had fewer than 100, including those from McAfee (21) and Trend Micro (30)

Link: Virusbtn

Post a comment · Send to friend Comments · There are 51 additional comments
(5 replies) #1 +stevember on 06 Sep 2008 - 10:08
Talk about headline blown out proportion. 16th is great when results marginal, still got high over 97%, look some on below 90%...

3rd paragraph missing 1st T.
#1.1 vetmarkjensen on 06 Sep 2008 - 10:58
Does it matter how many were worse? Does some other apps failing horribly somehow make OneCare a "great" product? You seem to think so.

To me, finishing 16th means that there are 15 products I would recommend before OneCare.
#1.2 +Smigit on 06 Sep 2008 - 11:25
(markjensen said @ #1.1)
Does it matter how many were worse?
I think he was making your point looking the other way in that "does it really matter how many are better if the difference is so small".

Yeah I'd look elsewhere too but if it is 97% then thats not too bad. Infact looking at it it got 97.7 and 97.1% respectively for malware and adware/spware. That puts it ahead of the likes of Nod32 (94.4%, 94.7%) and only just behind Kaspersky (98.4%, 98.3%) which seem to be the two more popular ones amongst Neowin users.

Really these tests never seem to have consistant results anyway IMHO. The winner of one test can be 20th in another.

Another thing in MS's favor here IMHO is the results are pretty consistent between the antivirus and spyware categories. Quite a few products that excel at one did pretty abysmal in the other. It wouldn't surprise me if you took an average of the results from the two test that MS could rank a fair bit further up overall for the sum of it's two parts.
#1.3 +stevember on 06 Sep 2008 - 19:10
(Smigit said @ #1.2)
(markjensen said @ #1.1)
Does it matter how many were worse?
I think he was making your point looking the other way in that "does it really matter how many are better if the difference is so small".



Thank you, nice see someone understands.
#1.4 vetmarkjensen on 06 Sep 2008 - 20:07
(Smigit said @ #1.2)
...
Yeah I'd look elsewhere too but if it is 97% then thats not too bad...
Compared to the 99% results?

Let's see. If a computer was exposed to a statistical spread of 100 pieces of malware, You would have to clean up one or maybe even zero infections that slipped by the top performer. With OneCare, you would have two or three.

You guys are looking at comparing 97 to 99. The infections come from the failures, people, not the "successes". So you are looking at a failure rate that is 4 times worse than Avast! (which is not even the top-performer) for anti-virus. (the stats for that are 99.3% vs. 97.1%, or 0.7% failure to 2.9% failure)

If you think getting 4 times as many misses is a good thing, then you may need a quick lesson in how to review these types of statistics, because (quite frankly) you are all screwed up in which side of the stats you need to look at.
#1.5 +Smigit on 07 Sep 2008 - 07:58
(markjensen said @ #1.4)
(Smigit said @ #1.2)
...
Yeah I'd look elsewhere too but if it is 97% then thats not too bad...
Compared to the 99% results?

Let's see. If a computer was exposed to a statistical spread of 100 pieces of malware, You would have to clean up one or maybe even zero infections that slipped by the top performer. With OneCare, you would have two or three.
Sure but the percentage based results don't allow for any indication of the severity of the attacks let past. If that 1% missed by one is more severe than the 3% missed by another then the 97% one is still probably better off.

Also as I mentioned, this is one test. These tests are hardly ever consistent amongst sites carrying them out and imho the only constant is the lack of consistent results shown. Really you can't read too much into them because for every test that says one anti virus is the best theres another dozen that says it's useless. Ones like Nod and Kaspersky didn't perform that well either, infact Nod did worse than one care. Many many test would put those two alot closer to the top however.

I'm not saying the results were great by any stretch of the imagination, what I and the OP are saying is they were blown out of proportion in how they are misanalysed. Many of the ones that beat OneCare in one category failed abysmally in the other which while attributing to One care being 16th for antivirus detection doesn't mean overall the product is worse. Yes theres products that did better in both categories, but just because it came 16th in antivirus detection doesn't mean it was 16th overall when the sum of it's parts are looked at.
#2 +Sethos on 06 Sep 2008 - 10:13
Umpossible!
(6 replies) #3 webeagle12 on 06 Sep 2008 - 10:16
omfg nod after microsoft double u te ef

I smell **** in this test

Last edited by webeagle12 on 06 Sep 2008 - 10:26
#3.1 +Lt-DavidW on 06 Sep 2008 - 11:59
Why? Because you don't want it to be true?

If you disagree then conduct your own test.
#3.2 excalpius on 06 Sep 2008 - 13:08
Many of us have...in the field...year after year. And NOD32 was the leader in detection, clean up, and lightest on resources. The new KAV just caught up in resources and even found one trojan that got past NOD32 a month or two ago, so it's the winner in my book.
#3.3 thenonhacker on 06 Sep 2008 - 15:52
EPIC PWNED!
#3.4 Airlink on 07 Sep 2008 - 04:46
(Lt-DavidW said @ #3.1)
Why? Because you don't want it to be true?

If you disagree then conduct your own test.

He can't. He doesn't know how to write in English. Just Gibberish.
#3.5 webeagle12 on 07 Sep 2008 - 05:19
(Airlink said @ #3.4)
(Lt-DavidW said @ #3.1)
Why? Because you don't want it to be true?

If you disagree then conduct your own test.

He can't. He doesn't know how to write in English. Just Gibberish.


would you like a tissue?
#3.6 cork1958 on 07 Sep 2008 - 11:24
(excalpius said @ #3.2)
Many of us have...in the field...year after year. And NOD32 was the leader in detection, clean up, and lightest on resources. The new KAV just caught up in resources and even found one trojan that got past NOD32 a month or two ago, so it's the winner in my book.


KAV has ALWAYS been #1 in ALL fields, unless you're a NOD32 fanboy!!
#4 +Harlem39s Finest on 06 Sep 2008 - 10:19
looks like i won't be renewing my licence for nod32...
#5 xSuRgEx on 06 Sep 2008 - 11:06
nice to see Sophos almost at the bottom

what about some of the other antispyware apps like "super anti spyware" that i keep hereing people say is o so great.
(2 replies) #6 kiddingguy on 06 Sep 2008 - 11:14
and how is this norton 2009 compared to kasperksy systemwise?
(if the 2009 (still) a resource hog or has symantec learned from past experiences?)
#6.1 excalpius on 06 Sep 2008 - 13:09
Never
Trusting
Symantec
Ever
Again

Period.
#6.2 Airlink on 07 Sep 2008 - 04:48
Norton Antivirus has = epic fail for as long as I can remember.
It's a steaming load. You may want to flush it.
(1 reply) #7 soumyasch on 06 Sep 2008 - 12:30
Kaspersky and Eset not even in the top ten! I just bought Kaspersky 2009 license two days back.
#7.1 excalpius on 06 Sep 2008 - 13:11
You made a wise investment. I've tested all of these in the field and KAV is now #1 with NOD32 a close #2. Not sure wtf is going on with this test but it smells MUCHO fishy.
#8 GP007 on 06 Sep 2008 - 12:45
I think that's pretty damn good for OneCare which is brand new into the a/v game, and so on. Lets see how good they can get it with v3.0.
(2 replies) #9 Glendi on 06 Sep 2008 - 12:46
lol These test are fake, the best test is testing them by yourself. I did it and Kaspersky and NOD 32 are the best of them all.
#9.1 excalpius on 06 Sep 2008 - 13:06
Agreed. When anything by Norton scores higher than the applications I use to clean up machines that Norton failed to protect there is something wrong, very wrong with this list.

When any of these other products failed over the past few years, I use NOD32 to clean it up. But NOD32 has fallen behind in rootkit detection, so the new Kaspersky was able to clean up the one machine that NOD32 failed to protect.

Someone want to explain what the hell is going on here?
#9.2 Glendi on 06 Sep 2008 - 14:23
(excalpius said @ #9.1)
Agreed. When anything by Norton scores higher than the applications I use to clean up machines that Norton failed to protect there is something wrong, very wrong with this list.

When any of these other products failed over the past few years, I use NOD32 to clean it up. But NOD32 has fallen behind in rootkit detection, so the new Kaspersky was able to clean up the one machine that NOD32 failed to protect.

Someone want to explain what the hell is going on here?


The tests are either made by fanboys, or some supporter. Just try antiviruses yourself. That's why there are trials.

NOD32 has one heck of a good heuristic system IMO, but Kaspersky beats it with its vast database virus.
(1 reply) #10 +Digix on 06 Sep 2008 - 13:40
avast free home edition is great
#10.1 Airlink on 07 Sep 2008 - 04:52
It is, actually. Supports x86, x86-64, Linux and Windows for free. And I mean free as in free to use. It's not shareware, There's no time-limit. Why pay money to Symantec or McAfee when Avast is better, free, faster and oh did mention it's FREE!?
(1 reply) #11 plastikaa on 06 Sep 2008 - 14:07
Please replace title with something appropriate... why do people take any opportunity they can to bash Microsoft?

If you want it about a specific product... please just make it something like "Beta version of GDATA's AVK 2009 tops charts in malware and spyware detection" I dont see why this article title should resolve around microsoft in anyway.

#11.1 coolvi on 06 Sep 2008 - 15:27
(plastikaa said @ #11)
Please replace title with something appropriate... why do people take any opportunity they can to bash Microsoft?

If you want it about a specific product... please just make it something like "Beta version of GDATA's AVK 2009 tops charts in malware and spyware detection" I dont see why this article title should resolve around microsoft in anyway.


Relax. This doesn't really prove a thing. A year later there will be something titled "OneCare Is Now The 'ONE.'"

How many times do we have go over this again? When you're dealing with any product from a large firm, quality isn't the winning factor. So IE had 1% of market share when it first came out and was inferior to Navigator...I'm not even gonna waste my time 'cause you get the idea.
#12 Neoauld on 06 Sep 2008 - 14:21
weird
these results conflict alot with virus.gr's results
#13 starless.bible.black on 06 Sep 2008 - 15:18
I agree with comments on picking the highly biased title. It really should be addressed to all the Eset believers here. It doesn't do very well at all in this test. But then, I also agree with others that the differences are marginal.
have we learned anything from this? nothing, you still have to try it for yourself to believe it and many times some of the test areas are highly system specific - what works for them may not work for you at all...

still using corporate Sym AV (v10.2) here, clean for 2 yrs.
#14 Hendrick on 06 Sep 2008 - 15:27
Does anyone know where I can download GDATA's AVK 2009? I've searched, and I can't seem to find anything. Speaking that mine only caught 65.5% of malware, and 68% on Adware, I think it's time for a new one. (ISP provided it.)
#15 random_n on 06 Sep 2008 - 16:39
The next run of http://www.av-comparatives.org/ should be out on the 15th. I always find their tests and presentation of results to be more interesting.
(1 reply) #16 Don Matteo on 06 Sep 2008 - 17:22
EDIT: nm, i see its for a section dedicated to ms news

Last edited by Don Matteo on 06 Sep 2008 - 17:35
#16.1 Airlink on 07 Sep 2008 - 04:53
What part of neoWIN don't you understand?
#17 bbfc_uk on 06 Sep 2008 - 18:31
I ask anyone who slates to try the new NAV and NIS 2009 products and then see if you have the same view!

Symantec have certainly learned their lesson and these programs load up extremely quickly, don't hog resources and they don't slow down the system boot time as much as previous versions. In fact, the 2008 versions were also very light compared to 2006, but the 2009 range is by far the lightest products Symantec have ever released.
#18 TC17 on 06 Sep 2008 - 19:31
Unless I'm missing something, that is NOT a rating list, that is an alphabetical order of virus scanners.
#19 TC17 on 06 Sep 2008 - 19:33
Funny how every other persons test is totally different than anothers test.
#20 +warwagon on 06 Sep 2008 - 23:11
First off

http://www.neowin.net/forum/index.php?show...t=0&start=0

2nd

I dunno. I recommend people just use the free stuff. Either AVG or Avast..

I only say this because I've seen people get infected while running every kind of antivirus under the sun .... Avast,AVG,Norton,Nod32,Mcaffee,OneCare, Panda, ect...

I tell people, imagine an antivirus as a little guy standing on the side walk with a little net, trying to catch you as you jump off the top of a 10 story building.

Its all in your habits. If you open and run everything you come across and don't keep your computer up to date, then no amount of antivirus will protect you.

Once a malware (That's all it is now days, its all malware) gets on your system, its compromised and can never be trusted again (Could never do E-banking on it), without a reformat.

I do install WOT (web of trust) to help scare them when they go to to bad sites
#21 plan-9 on 06 Sep 2008 - 23:52
lol at people saying the test is written by fanboys just because nod32 didnt come out #1. the irony is great.

as for the title, yes it should be changed. no idea why ms's onecare is even mentioned. the article is not about onecare..its about a bunch of security products.

Some very solid numbers from many products.

*EDIT*

Decided to uninstall nod32 to give Gdata a try. First off its over 100 megs. Kinda big for a virus scanner imo...especially after you see what the gui looks like..its quite plain. Next when the app window is on screen the mem usage jumps to over 100 megs..when its minimized it drops a whole lot. Next it seemed quite slow to do an update...it was an initial update so the next updates should be much quicker. However, the on demand scanner is dreadfully slow. This is the 2008 product..perhaps the 2009 version is better. But as it stands even with incredible detection rates I dont think I would like having this running. I think the next one I give a try to will be F-secure. Used to run their products and was quite happy. Might even give kaspersky another shot. Theres a nice warm spot in my heart for kaspersky. Back in the day it was the only product that cleaned the dreaded CIH virus. Always had an issue with the product being quite unstable though. Might even try out norton 2009. Kinda nervous..always have bad memories of their products completly messing up a perfectly good windows install.

Last edited by plan-9 on 07 Sep 2008 - 01:35
(2 replies) #22 James Riske on 07 Sep 2008 - 00:30
It's always good to see the top 3 rated are actually free versions.

And it's always refreshing to see the fanboys get all bent and pumping out excuses as usual.
#22.1 excalpius on 07 Sep 2008 - 06:37
The "fanboys" became "fanboys" for a reason. The fact that this test goes completely contrary to the results of better known tests, as well as what appears to be the collective experience of many, many experts here on these forums calls the test results into question.

Last edited by excalpius on 07 Sep 2008 - 11:44
#22.2 Magallanes on 07 Sep 2008 - 12:51
(excalpius said @ #22.1)
The "fanboys" became "fanboys" for a reason. The fact that this test goes completely contrary to the results of better known tests, as well as what appears to be the collective experience of many, many experts here on these forums calls the test results into question.



The fanboys became *ahem* fanboys because the lack of rational thinking. In this case, there are several free products that can beat expensive products.

Anyways, there are several test, mostly (the more "famous" are just ads-in-disguise, or you could say, food for fanboys.




#23 JorgeIvan on 07 Sep 2008 - 09:23
Avira ftw thats what im using
(1 reply) #24 krunvisaurus on 07 Sep 2008 - 15:22
As someone out in the field, on a daily basis, any chart that doesn't have NOD32 in the top 3 is full of crap.
I shall ignore any posts from this site from now on. Good day.

#24.1 +imis on 08 Sep 2008 - 04:32
(krunvisaurus said @ #24)
As someone out in the field, on a daily basis, any chart that doesn't have NOD32 in the top 3 is full of crap.
I shall ignore any posts from this site from now on. Good day.

i agree with you if nod 32 is not there it mean there is some thing drastically wrong with the test.
(2 replies) #25 toadeater on 07 Sep 2008 - 22:19
One Fail
#25.1 +GreyWolfSC on 08 Sep 2008 - 01:00
(toadeater said @ #25)
One Fail


You must mean your comment?
#25.2 AfroTrance on 08 Sep 2008 - 07:57
BURN!
(1 reply) #26 +Hills420 on 08 Sep 2008 - 01:31
What, no Spyware Blaster or Spybot S & E??
#26.1 +warwagon on 08 Sep 2008 - 05:03
Spyware Blaster isn't a scanner.

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)