Hack Forums
[BHCPU] Antivirus Products Test Results - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Keyloggers (https://hackforums.net/forumdisplay.php?fid=113)
+---- Thread: [BHCPU] Antivirus Products Test Results (/showthread.php?tid=4583531)

Pages: Pages 1 2 3 4 5 6 7

[BHCPU] Antivirus Products Test Results - -Hyperion - Dec 13, 2014

[Image: 2xNRisW.png]
Hey guys, it's Hyperion ✌
I have 5 years of experience with removing malware, 3 with pentesting (penetration testing) and now work for a fortune 500 company.

Today I will be testing 19 of the most popular Antivirus products for you in order to help you make an informed decision.
There will be 8 free products and 9 paid tested and they will each be rated on performance during idle, interface, protection and removal (1-10 scoring with 10 being the best). Malwarebytes and Herdprotect will be tested as a bonus too.

All versions are tested on a fresh install of Windows 7 Home Premium SP1 64-bits VM (Virtual Machine, under VirtualBox) with most recent updates and only a few tools installed (Process Explorer, Malwarebytes and AdwCleaner). Each Antivirus will be installed, then 5 infected links will be opened in Internet Explorer 11 and 10 different pieces of malware will be tested (worms, trojans, ransomwares and a rootkit). The links and malware are all fresh samples less than 24 hours old from VirusTotal and are in different forms from .exe to Microsoft Office Word documents.

After each test is done the box will be restored completely to it original state (using a snapshot that was taken after a clean installation). I will be using Process Explorer to monitor, and run a Malwarebytes/AdwCleaner scan after each test to see if any residual files are found and what PUPs the AVs may have installed.

[img]http://myphotos.mypclinuxos.com/images/Abraxas012X/avastl.png[/img]
avast! Free
Infected Links : 10/10
Infected Files : 10/10
Interface : 6/10
System Impact : 10/10
.4% cpu 9MB ram
Has a potentially annoying voice(can be turned off) and complex interface also it tries to install a Google toolbar and Chrome during installation.

[img]http://im.tech2.in.com/gallery/2011/sep/avg_finaltext242_141838496597_640x360.jpg[/img]
AVG Free
Infected Links : 10/10
Infected Files : 10/10
Interface : 7/10
System Impact : 10/10
.3% CPU, 2MB RAM
Dood user friendly interface, includes rootkit protection but it did ask to install the AVG toolbar twice after it was installed. Did not stop file immediately on download, took up to 10 seconds to scan and stop a file which long enough for me to potentially execute one.

[img]http://mydownload.me/software/programs/security/Anti_virus/Avira/logo/Avira_antivirus_computer_icon.png[/img]
Avira Free
Infected Links : 5/10
Infected Files : 7/10
Interface : 8/10
System Impact : 7/10
10% CPU, 14MB RAM
Tried to offer free addons and it did include Dropbox with the install. One of the few free include a firewall.

[img]http://www.techandsoft.com/wp-content/uploads/2012/07/Panda-Cloud-Protection.jpg[/img]
Panda Cloud Antivirus
Infected Links : 9/10
Infected Files : 10/10
Interface : 7/10
System Impact : 8/10
.7% CPU, 25MB RAM
Tried to install Yahoo toolbar and Mypage as default homepage to many "ads" on interface on the interface.

COMODO Internet Security
Infected Links : 7/10
Infected Files : 4/10
Interface : 4/10
System Impact : 7/10
.9% CPU, 10MB RAM
Full Suite! Asks on detection if you want a geekbuddy to remove it or clean it yourself. Let me actually open 6 of them before giving a warning. Changes DNS to theirs and home page to Yahoo, installed geek buddy and comodo dragon browser. Every time you open the interface it pops up with "call technician".

[img]http://securitysamurais.com/wp-content/uploads/2013/09/kaskpersky-coupon-codes.jpg[/img]
Kaspersky Internet Security
Infected Links : 10/10
Infected Files : 10/10
Interface : 10/10
System Impact : 6/10
.1% CPU, 85MB RAM
Awesome AV suite and one of my favorites if you have a good computer to run it.

[img]http://www.eset.co.ke/resources/graphics/eset_logo_dark.gif[/img]
ESET Nod32
Infected Links : 10/10
Infected Files : 10/10
Interface : 9/10
System Impact : 7/10
.1% CPU, 54MB RAM
Excellent AV and I would use it if I did not have a chub for Kaspersky. Cannot go wrong with either.

[img]http://siliconangle.com/files/2011/09/Norton-Logo.jpg[/img]
Norton 360
Infected Links : 5/10
Infected Files : 13/10 (deleted parts of itself)
Interface : 3/10
System Impact : 2/10
13% CPU, 122MB RAM
Wtf these resources during idle.The damn map that shows real world protection they are fighting live still works offline and worse of all part of itself got infected and it tried to delete itself. McAfee is is the same boat so stay away from these two.

[Image: jpqK2aza_400x400.png]
F-Secure Internet Security
Infected Links : 10/10
Infected Files : 10/10
Interface : 10/10
System Impact : 8/10
.1% CPU, 35MB RAM
Very light weight AV that did extremely well would highly recommend to someone who wants a payed AV.

[Image: icon256_shield_2d.png]
Emsisoft Internet Security
Infected Links : 10/10
Infected Files : 10/10
Interface : 9/10
System Impact : 7/10
.3% CPU, 65MB RAM
Another great AV that uses 2 different engines to scan your system. One of the most friendly and easy to use I have ever seen.

Microsoft Security Essentials (now Windows Defender under Windows 8/8.1)
Infected Links : N/A
Infected Files : 3/10
Interface : 9/10
System Impact : 10/10
.1% CPU, 7MB RAM
Piece of shit from Microsoft that cannot keep up with latest threats and has a backdoor bigger then Blackshades. I would highly recommend using anything over this.

Malwarebytes AntiMalware Security
Infected Links : N/A
Infected Files : 7/10
Interface : 10/10
System Impact : 9/10
.2% CPU, 25MB RAM
Found the 3 files it missed after they where run with a full scan. Surprising done well for not being an AV. With more and more Malware being trojans etc this could be a viable choice in another year. Still a must have for checking for infections.

[img]http://s52.radikal.ru/i137/1403/22/78287617268f.jpg[/img]
Qihoo 360 Internet Security
Infected Links : 10/10
Infected Files : 10/10
Interface : 10/10
System Impact : 8/10
.1% CPU, 60MB RAM
Holy balls batman this shit is crazy fast. One of the fastest I have ever seen. Qihoo internet security was tested as well and the main difference is it used 10 mb less ram but has 2 less AV engines it scans with. This is hands down my new favorite free AV! It is also very easy to use file exception. perfect for you blackhats 🤫

[img]http://cdn.techpp.com/wp-content/uploads/2010/10/bitdefender_logo.png[/img]
Bitdefender Total Security
Infected Links : 10/10
Infected Files : 10/10
Interface : 8/10
System Impact : 6/10
.3% CPU, 111MB RAM
Little heavier then even Kaspersky still not as bad as Norton. Very good engine that other AV's use. It does include tune up and file encryption.

[img]http://www.comvio.eu/sites/default/files/LogoSophos.jpg[/img]
Sophos On Premise
Infected Links : 10/10
Infected Files : 10/10
Interface : 9/10
System Impact : 2/10
2% CPU, 678MB RAM
Ho lee shiiiiit if not for the huge ram usage do to multiple features this would be a Kaspersky killer. Nice clean, crisp, interface and one of the few to detect my samples even as a zip file which means it is proactively scanning.
This is definitely a must have if you a sysadmin with lots of users ( they more enterprise geared) I would use this if I had 16GB or more of RAM.

Trend Micro Maximum Security
Infected Links : 9/10
Infected Files : 10/10
Interface : 6/10
System Impact : 8/10
.4% CPU, 38MB RAM
Excellent for enterprise and while they score highest on AV comparatives their end user interface is slow and the scan engine took 3 minutes to find all threats after unpacked. Long enough for me to potentially execute a file that could disable it.

Ahnlab v3 Internet Security
Infected Links : 4/10
Infected Files : 7/10
Interface : 4/10
System Impact : 10/10
.5% CPU, 5MB RAM
Lightest weight AV tested,includes option of installing their firewall by default, which then tried to block itself from accessing the internet during database update. Very early 2000's feel to the interface.

F-PROT Antivirus
Infected Links : NA
Infected Files : 7/10
Interface : 5/10
System Impact : 9/10
.1% CPU, 12MB RAM
Very reminiscent of Clam AV, more geared towards linux then windows. Not updated since 2011.

And bonus! herdProtect
Infected Links : N/A
Infected Files : 10/10
Interface : 8/10
System Impact : 8/10
.1% CPU, 32MB RAM
68 engines included but it is only a 2nd line of defense you can use with an AV. Not an actual one with real time protection. Did find all malware after it was was installed but, took forever to scan.

My closing thoughts are that Qihoo or Panda Cloud are the best choices for free and that for paid products, you cannot go wrong with Kaspersky, ESET, Emsisoft or F-Secure. You get what you pay for and most of the paid products are complete suites with a firewall. Almost all Antivirus will detect new threats within 24 hours now and will only miss a FUD (Fully Undetectable) file. Though some now will detect malicious behavior and warn you. A little common sense is still the first line of defense. I hope that this has given you some insight into which Antivirus product you should get and use. It still is up to you to pick the one that meets your needs.

Thread formatting, editing and add-ons done by Aura

* - Hunting Rifle - Dec 13, 2014

Nice thread skid.
Make the next one about fake positives on virus total.

* - Aura - Dec 13, 2014

(Dec 13, 2014 07:17 PM)Hunting Rifle Wrote:  Nice thread skid.
Make the next one about fake positives on virus total.

Don't give him thread ideas, guess who's stuck doing the formatting so it looks decent after 🤫
Also, big fucking lol at the comments, I'm dying on my char everytime I read them.

* - -Hyperion - Dec 13, 2014

(Dec 13, 2014 07:17 PM)Hunting Rifle Wrote:  Nice thread skid.
Make the next one about fake positives on virus total.

That is a great idea how to read a report etc

* - Aura - Dec 13, 2014

(Dec 13, 2014 08:30 PM)-Hyperion Wrote:  That is a great idea how to read a report etc

Throw other reports in it, like malwr.com, hybrid-analysis, Anubis, etc.

* - Aura 2.0 - Dec 13, 2014

Did all the VMs have the exact same specs?

* - -Hyperion - Dec 13, 2014

(Dec 13, 2014 08:33 PM)Mapl3 Wrote:  Did all the VMs have the exact same specs?

Yes all where exactly the same Maple

* - Paathurnax - Dec 14, 2014

Came to this thread from the link you posted on another thread ten minutes ago.

This was a good read actually. I'm glad I clicked. The part about Norton getting itself infected and trying to delete itself made me laugh.

* - -Hyperion - Dec 14, 2014

I am thinking of adding a shit ton more tests just to see how other products do

* - KFC Watermelon - Dec 15, 2014

There is no way antivirus software like AVG are using 2MB of RAM. There are hidden processes and services that use additional RAM and are not visible in task manager as they run above userland. The real tests are CPU bound and how fast the scanner works.

You also gave little information about the threats thrown at the security software.

Other than that, thank you for taking your time to test these products. In my experience, Kaspersky and ESET are top tier, ESET is a complete bitch to deal with for malware coders. COMODO use to be great...No so much anymore.

Windows defender is a joke. I love malwarebytes, but I have personally seen it let in so much adware and malware that it shouldn't had.

* - Aura - Dec 15, 2014

(Dec 15, 2014 07:33 PM)KFC Watermelon Wrote:  There is no way antivirus software like AVG are using 2MB of RAM. There are hidden processes and services that use additional RAM and are not visible in task manager as they run above userland. The real tests are CPU bound and how fast the scanner works.

You also gave little information about the threats thrown at the security software.

Holy fuck you are still alive. Please work on KFCleaner to make it more efficient.

* - -Hyperion - Dec 15, 2014

(Dec 15, 2014 07:33 PM)KFC Watermelon Wrote:  There is no way antivirus software like AVG are using 2MB of RAM. There are hidden processes and services that use additional RAM and are not visible in task manager as they run above userland. The real tests are CPU bound and how fast the scanner works.

You also gave little information about the threats thrown at the security software.

Other than that, thank you for taking your time to test these products. In my experience, Kaspersky and ESET are top tier, ESET is a complete bitch to deal with for malware coders. COMODO use to be great...No so much anymore.

Windows defender is a joke. I love malwarebytes, but I have personally seen it let in so much adware and malware that it shouldn't had.

thank you for your kind words. To give more info process explorer was used and these measurements where taken during idle it was more a general idea to be user friendly to understand. The threats where from virus totals free pack and where less then 24 hours old. I can send you the pack of what was ran but it included some trojans, worms, rootkit and a variant of zeus.

* - Mаtt - Dec 15, 2014

I've never heard of Emisoft, but I guess it's a good thing I stopped recommending Avira. I've moved to Avast over the last 2 years and I've noticed that it's much better and I find the interface not too bad. I've used it more often than most though so maybe that's why. I was a huge fan of ESET NOD32 as well.

Great read altogether and actually took some "notes" down from this.

* - AAE32 - Dec 16, 2014

Thats wasnt nice

[Image: 5ea4e62979d5a74c7a333a0bee992708.png]

Well if you think about panda cloud antivirus sometimes it dosent even detect uncrypted darkcomet stubs and ohter rats stubs.

Virustotal Darkcomet Scan

[Image: 0942af420f94212cf9f4d05bb35d3ea9.png]

[Image: c7458b762a197186060fd603dd28299d.png]

* - Aura - Dec 16, 2014

(Dec 16, 2014 04:25 PM)AAE32 Wrote:  Thats wasnt nice

[Image: 5ea4e62979d5a74c7a333a0bee992708.png]

Well if you think about panda cloud antivirus sometimes it dosent even detect uncrypted darkcomet stubs and ohter rats stubs.

Virustotal Darkcomet Scan

[Image: 0942af420f94212cf9f4d05bb35d3ea9.png]

[Image: c7458b762a197186060fd603dd28299d.png]

Did you try it in real time ? If not, I will for you in a VM tonight.