Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: true indian on May 19, 2012, 06:29:21 PM
-
http://chart.av-comparatives.org/chart3.php
we are in 2012 in blocked + UD
If u look at 2012 and all years blocked results we are like muttering between 3st and 5th...thats very good
WE ROCK!!!! ;D 8)
-
Well........... I tried viewing that unintelligble crap in 4 different browsers. Wouldn't you think they could at least produce a readable graph?
-
Well........... I tried viewing that unintelligble crap in 4 different browsers. Wouldn't you think they could at least produce a readable graph?
Make the zoom to 90-100% in chrome...that looks better ;D
-
We're going up... From ~94% to ~98%... Congratulations...
Take the long term picture (2010 to 2012) and you'll see the improvement better.
-
We're going up... From ~94% to ~98%... Congratulations...
Take the long term picture (2010 to 2012) and you'll see the improvement better.
Yep! ;D Hahaha....Look at the all years result blocked we are LIKE ON 3RD!!! ;D
-
Qihoo 360...I have tested it many times against so many stuff and its really bad!!
looks like somebody is cheating
-
(2012 – 2012) Dramatic improvement for Bitdefender!
However I prefer more stable products.
-
We're going up... From ~94% to ~98%... Congratulations...
Take the long term picture (2010 to 2012) and you'll see the improvement better.
Indeed, excellent progress. Thanks for the info. true indian. :)
All my best!
Jim
---
-
No problem!Jim good to see avast moving towards the top...i wouldnt count qihoo...it seems like av-comp is been payed by qihoo to display these results
And of course if u consider the multiple AV engines using AV's like gdata fsecure we are the 5th best AV out there and if u dont consider them we are the 3rd best AV out there. ;D
-
I'm not that impressed. If they'd put 5% effort into Behavior Shield and making it even function at all, we'd be looking at 99,99% figures since the release of v5. But instead it's just a waste of shield space for 3 major versions because it does NOTHING to the end user. Tested it yesterday (for the 20th time this year), installed only Behavior Shield, left only rootkit and malware-like behavior enabled to avoid excess blocking of every random protected thing and set it to block. Executed like 50 samples of known malware. Not a single thing was even analyzed, let alone being blocked. Which means avast! 7 doesn't have any malware-like behavior rules. At all.
I don't even know why does it have a name Behavior Shield. It should be called "Just some scanning shield with no real purpose". Because that's what it is. And as much as i like avast! and how much i've been supporting it for the last years, this is really pissing me off. Every other vendor that introduced behavior blocker in their program also showed off some excellent results (i've tested them myself as well. But avast!, nothing for the last 3 years, since the v5 when we got the Behavior Shield. This module should have been hidden from the day 1 because it is apparently designed to only monitor things but is instead giving users a false sense of security (knowing how behavior blockers are effective in general). One of the biggest disappointments with avast! in years really and it still keeps on disappointing me. And frankly i'm not really sure what was avast! team thinking when they designed this module. I just can't understand their logic...
Only thing that's really holding avast! afloat is cloud (file reputation) and Auto Sandbox. Where Auto Sandbox is again like Behavior Shield just a dumb module that just sandboxes stuff for 15 seconds and terminates them without any verdict at all even though interface suggests it will maybe sometimes give some verdict. But it never does. I'd understand not giving a verdict for some stuff because it just can't make one, but not giving any verdict in all my tests ever since v7 was released (and trust me i tossed loads of malware at it), nothing.
-
Where Auto Sandbox is again like Behavior Shield just a dumb module that just sandboxes stuff for 15 seconds and terminates them without any verdict at all
Not true i have seen autosandbox in action many a times....it also did show 1 time that the file is probably malware on my sister machine...U should go get a malware that tries to connect to Net and connect with backdoor and that get caught in autosandbox
My sister about 1 month ago was using avast 7.0.1426 and she downloaded some piece of malware that was autosandboxed by avast....the malware tried to drop a win32.ransom that avast picked up with with file guard and avast also picked up the malware URL connection the malware was doing...all this happened when file went to sandbox and then about 15 sec later it showed that the file probably malware
Also i have tested autosandbox with some undetected malware/adware....and it did autosandbox many of them...say about more than 1/4th of them
Also u can move behav shield to ask and it behavs like HIPS ;)
-
You don't understand what i was talking about. I never said it doesn't sandbox things, i've said it NEVER gives a verdict on what malware is trying to do inside sandbox. Read the Auto Sandbox popup once and you'll see what the text on it says. And what will always say no matter what gets sandboxed. Even verified malware will always end up with no verdict on what it is so user is left clueless and the just exclude for stupid Auto Sandbox popup to finalyl go away and stops bothering them. That's what most do in the end because of it...
-
You don't understand what i was talking about. I never said it doesn't sandbox things, i've said it NEVER gives a verdict on what malware is trying to do inside sandbox.
I do understand what u say....cozz for me it has given conclusions that file is malware...
Make sure u are running some genuine piece of malware against it that tries to drop files and create a backdoor and u will see the final verdict as malicious in red
The malware should be like dropping files on computer that avast file guard can pick up and creating backdoor connections that network shield can pick up
-
for me i feel that the autosandbox is pretty decent in catching unknown threats and it is not stupid in my opinion. (rather it is the phrasing that causes indecision)
however, i do think that the pop-up information does need better phrasing to prevent confusing normal users.
refer to screenshot.
i feel that the statement with the highest threat level warning should be the one displayed. that means if avast auto analysis of the program does not find any malicious intent of the program, it should only display the very reason for autosandbox to be triggered in the 1st place (eg. replacing the sentence "we did not find enough evidence to identify the file as malware" with "static analysis finds the file suspicious"). of course, if analysis finds malicious intent in the program, it will take precedence over the initial autosandbox reasoning - instead of showing "static analysis finds the file suspicious" show " the file appears to be malware".
this will help a lot of users in making decisions when seeing autosandbox alerts. as of now, the 2 statements in autosandbox analysis is potentially confusing to normal users.
-
It gave the same reson for bunch of Steam games and other known clean stuff so that's hardly any verdict at all. The thing at which your arrow points at never changes. It's never enough evidence, just like there apparently are no rules that would even trigger behavior shield either.
-
This is going to much off topic... ::) But anyway.. ;D
here are certain things i recognized in avast autosandbox that makes it show the file is malware warning:
-The malware should drop malicious files that get picked up by file shield
-the malware should try connecting to maicious URL's that network shield can pick up
-And of course it should be running in avast sandbox while doing all that ;)
-
That's all in theory but in real world i've maybe seen it do that like twice, maybe... Other gazillion times, nothing. Got sandboxed and no additional warnings or verdics were given.
-
That's all in theory but in real world i've maybe seen it do that like twice, maybe... Other gazillion times, nothing. Got sandboxed and no additional warnings or verdics were given.
Well...the thing i mentioned is what is supposed to be actually called malware behaviour by autosandbox...and this what a regular user will come across ::)
Again this topic is for avast 7 av-comp results...isnt all this stuff supposed to be in an another thread hmmm.... ???
-
And what you said pretty much never happens. And yes, it has to do with AV-Comparatives. It's the real world test where things get executed and if they'd actually make things right, we wouldn't be 5th best but first or second best. Because being 5th is nothing to be cheerful about, even with free version. Because as far as protection modules go, paid version isn't any different, making paid version look bad as well.
-
And what you said pretty much never happens. And yes, it has to do with AV-Comparatives. It's the real world test where things get executed and if they'd actually make things right, we wouldn't be 5th best but first or second best. Because being 5th is nothing to be cheerful about, even with free version. Because as far as protection modules go, paid version isn't any different, making paid version look bad as well.
and how that makes sense...when it is sandboxed it should be counted as a block isnt it ???
-
When an expert is sitting in front of a computer, yes. But when it gets sandboxed in front of a casual user, he sees that as an annoyance. How do you know they won't just exclude it or disabled Auto Sandbox if it doesn't give any clear indication what the thing that got sandboxed really is? If it says "Sandboxed because it is trying to modify many system files", most will get scared and leave at it. But if it says there wasn't enough data to make a conclusion, 99% of users will consider it safe and run it outside the sandbox. And then all the crap will spawn...
As much as they've thought things to take clueless users into account they haven't thought about this at all. And what AV-C says as a real-world score doesn't really reflect it in actual real world. And that's what i'm concerned about. Being 5th with such way of doing things makes it even worse than it scored...
-
isnt the static analysis finds file suspicious reason enough for a average user??
-
good work avast team keep it up i must say.
-
isnt the static analysis finds file suspicious reason enough for a average user??
When it says that on pretty much anything even mildly suspicious it kind of loses its purpose. Even for me as an advanced user, seing it trigger bunch of times on clean files it even almost made me disable this darn thing altogether and just keep file reputation feature on...
-
isnt the static analysis finds file suspicious reason enough for a average user??
When it says that on pretty much anything even mildly suspicious it kind of loses its purpose. Even for me as an advanced user, seing it trigger bunch of times on clean files it even almost made me disable this darn thing altogether and just keep file reputation feature on...
I guess a normal user...wouldnt touch it even if it comes up with the same reason or will he/she??
-
It's a far lower chance of them running it anyway...
-
Well i have also seen some alerts with reason: filerep is low/heuristic context
-
Low reputation spawns a window of it's own with "Abort connection" being default. Plus there is a good description in the window that appears for it.
-
hmm for me i do not find the static analysis triggered often though. i have more incidents of low reputation triggers. thus i trust static analysis quite highly.
though i do wonder why steam games do trigger static analysis. it would be good if an expert from avast shed some light on it :)
-
I haven't seen a trigger of the sandbox in many month. :o
-
hmm for me i do not find the static analysis triggered often though. i have more incidents of low reputation triggers. thus i trust static analysis quite highly.
though i do wonder why steam games do trigger static analysis. it would be good if an expert from avast shed some light on it :)
Same here :)
-
I haven't seen a trigger of the sandbox in many month. :o
+1 The Behavior Shield should do more than just sit there. :)
-
I haven't seen a trigger of the sandbox in many month. :o
But are you installing software, testing things... Otherwise, I don't think you'll see it screaming :)
-
Unless you play indie games on Steam a lot. Then you'll see it a lot as well...
-
I thought this thread was about useless (IMHO) controlled test results. The only results that matter to me is the one I do every time I use my laptop. Period. :)
-
My experience with avast! auto-sandbox has been very limited. Since I installed version 7.0 it has been non-existent.
When I was running avast! AIS 6 on W7 Radio Sure would get auto-sandboxed.
When I replaced W7 with W8-DP I had to switch to Windows Defender. Radio Sure ran fine with no problem.
When avast! AIS 7 was released I replaced Windows Defender with it on W8-CP which I had upgraded to from W8-DP. avast! AIS 7 has never asked to auto-sandbox Radio Sure on W8-CP
One thing about W8-DP, W8-CP and I imagine the final release of W8 is that it does a very good job of checking the installation executable when you go to install a program. In fact it has blocked a couple of 3rd party programs from installing that I wanted to install. They could have been malicious hence a block or just not on Microsoft's Security Assurance list hence a block. Since W8 is blocking programs from installing this could explain why I have never had avast! AIS 7 ask to auto-sandbox anything. Whatever avast! is looking for as a possible auto-sandbox candidate W8 prevents from installing in the first place hence nothing for avast7 to find and auto-sandbox.
I have no idea of why Radio Sure was but is no longer being captured by auto-sandbox. Could be a change in Radio Sure, a change in auto-sandbox and/or due to W8.
-
The only notice I've ever received in Windows 8 is that .exe files might harm your system.
-
I thought this thread was about useless (IMHO) controlled test results. The only results that matter to me is the one I do every time I use my laptop. Period. :)
Yep!
-
why not set behaviour shield to ask and then test it? :P
-
That's just useless that way. You may just as well spam the user with bunch of useless random questions/dialogs and call it a day...
-
That's just useless that way. You may just as well spam the user with bunch of useless random questions/dialogs and call it a day...
hmm.....well i had it on ask and a few days ago i was re-installing some things and it didnt alert on them...just alerted me on 7-zip re-install and all other software installed correctly :P