All antivirus scanners can be tricked?

 All antivirus scanners can be tricked?

The heart of the antivirus scanner test at AV-Comparatives is the so-called real-world test, which is passed in four sections of two months each. It is responsible for 80 percent of the protection rating and is incredibly complex because the testers first search for infected websites with a Windows system with all updates, but without a virus scanner. 

If the PC is infected by any means, the testers have found an exploit for their arsenal. 1,512 test cases that infect Windows came together and every virus scanner had to face these threats. With F-Secure SAFE and Trend Micro Internet Security, there were only two virus scanners in the entire test field that could slow down all malware, a strong performance. Even the test winner from Kaspersky had to pass three times, the free solutions Avast and AVG four times. Windows Defender wasn't bad either, failing to fend off just six attacks. 

In comparison: Total Defense Essential Antivirus, a free antivirus monitor, had to surrender 24 times. In the last test, the problem often emerged that the antivirus scanners asked the user what to do if they had doubts about whether it was a malware or not. Then we go very tough because we actually expect the guards themselves to know the best and not to shirk a decision. 

Whenever there are user queries, we allow the maximum possible in the test and then check whether there is an infection. With this we cover the case that when asked in real life, users simply make the wrong decision. However, this is not a big problem in this test, only with Norton 360 Deluxe there were four infections in this way. All other test candidates kept a clean slate despite being asked.

Under fire: the virus scanner had to go through

All antivirus softwares at the same time

In the real-world test, it does not matter which protection technology the virus scanner uses to ward off the attacks. Classically, this can be a signature as well as a heuristic or a reputation query in the cloud. In the test, it is only important to us that in the end there is no infection on the tested system. However, only external attacks are tested. For maximum equality of opportunity, each virus scanner in the test runs on its own Windows 10 system with all updates. 

A manual update is started on all test PCs before each test run. The virus scanners run in the standard configuration and of course also have Internet access. A script triggers the tests in parallel on all machines, and special monitoring software logs the changes to the system in order to determine an infection without any doubt.

Mass test with malware 

In addition to the real-world test, which relies solely on the Internet infection vector, a so-called malware protection test is also carried out. This is a classic mass test with 10,102 malware samples stored on a hard drive. In practice, malware could also be introduced into your system via a USB stick or an external hard drive, for example. In this case, the virus scanner cannot prevent malware from getting onto your system, but should still detect it during a scan.

Compared to the real-world test, the malware protection test only makes up 20 percent of the protection rating, so it is much less important. A distinction is made between three cases: The first case is an offline scan in which the virus scanner is not allowed to use an Internet connection. This simulates the situation that there is currently no Internet connection available or that the virus scanner provider's servers are not available. Both can happen in practice. In the second case, the virus scanners can then also use their online functions. Up to this point, the malware was only passively on the system; in the third case, the testers then execute it. At this point at the latest, the virus scanners tested must recognize the malware and slow it down. 

In contrast to the real-world test, there are some serious differences there: Trend Micro Internet Security still recognized all malware in the real-world test, but performs worst in the mass test. The software does not recognize a full 175 malware samples. Offline detection is particularly bad; not even 40 percent of malware is detected here. With online support, the detection rate increases to almost 85 percent, and when it is executed, it is a little over 98 percent. All in all, it's underground when you see that there are virus scanners that can detect all pests. 

The free antivirus scanners Protegent, Avast, as well as G Data and McAfee, do not afford any faux pas. Test winner Kaspersky can only be tricked by malware, and F-Secure and Bitdefender are also at this level. If you look at the RealWorld and Malware Protection tests together, however, no virus scanner manages to keep a completely clean slate. Overall, F-Secure provides the strongest protection and only missed one malware in the entire test, the average being 21 overlooked viruses. The good news for users: The free solutions Protegent and Windows Defender leave many payment products behind.