Author Topic: Terrible results in Removal Tests  (Read 11252 times)

0 Members and 1 Guest are viewing this topic.

Offline avastfan18

  • Jr. Member
  • **
  • Posts: 25
Terrible results in Removal Tests
« on: December 15, 2011, 01:07:52 PM »
http://av-comparatives.org/images/stories/test/removal/avc_removal_2011.pdf
Avast! is LAST
You should improve disinfection avast team!

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85943
  • No support PMs thanks
Re: Terrible results in Removal Tests
« Reply #1 on: December 15, 2011, 02:06:23 PM »
I have to say I'm not impressed by this, not by  the poor cleaning of the samples by avast but by the test itself.

To me reading the Test-Proceedure and malware selection, it just doesn't mirror real world use.

First infecting a system under the Administrator account with no AV present; it has to be a malware dropper that the AVs on-demand/on-access scanner already detects; then install the AV.

To me that is crazy, the whole point of an on-access AV is to prevent infection, so if it can detects the dropper in the first place it would prevent the infection, rendering the cleaning process redundant.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.9.2494 (build 21.9.6698.703) UI 1.0.672/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline avastfan18

  • Jr. Member
  • **
  • Posts: 25
Re: Terrible results in Removal Tests
« Reply #2 on: December 15, 2011, 02:50:05 PM »
I have to say I'm not impressed by this, not by  the poor cleaning of the samples by avast but by the test itself.

To me reading the Test-Proceedure and malware selection, it just doesn't mirror real world use.

First infecting a system under the Administrator account with no AV present; it has to be a malware dropper that the AVs on-demand/on-access scanner already detects; then install the AV.

To me that is crazy, the whole point of an on-access AV is to prevent infection, so if it can detects the dropper in the first place it would prevent the infection, rendering the cleaning process redundant.

I agree with you - it's weird... BUT... when someone with infected PC installs avast! then Avast! fails because it has poor cleaning process.
So really avast! should improve cleaning process.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33369
  • malware fighter
Re: Terrible results in Removal Tests
« Reply #3 on: December 15, 2011, 02:52:16 PM »
Hi DavidR,

Does not surprise me one bit either. No resemblance to the real world theater. Made to suit the workings of certain av solutions better than others. It reminds me of the mythical story of Procustos bed. Everyone was made to fit in a very painful manner. Only those that fit the bed did not suffer.

polonus

Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85943
  • No support PMs thanks
Re: Terrible results in Removal Tests
« Reply #4 on: December 15, 2011, 03:32:55 PM »
<snip quote>

I agree with you - it's weird... BUT... when someone with infected PC installs avast! then Avast! fails because it has poor cleaning process.
So really avast! should improve cleaning process.

Well when running a system without any AV, the users is playing Russian roulette and has to take some responsibility for the consequences of their action/inaction.

In a perfect world, yes it would be nice if they could clean all infections present on the system at the time of installation, but that may not always be possible. We do however, see many instances in the viruses and worms forum, where avast does just that, but that isn't 100%.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.9.2494 (build 21.9.6698.703) UI 1.0.672/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline ady4um

  • Massive Poster
  • ****
  • Posts: 2667
Re: Terrible results in Removal Tests
« Reply #5 on: December 15, 2011, 05:02:36 PM »
Although avast could improve the cleaning capabilities, I'd rather always put the priority in detection first.

There are other tools for cleaning, and even better than that, users that are specialist on cleaning malware (with logic, knowledge and brain).

Those tools targeting cleaning aspects are a complement to avast detecting capabilities.

So, from my point of view, the test is just one additional parameter. I don't question how "valid" or "close to reality" the test is. It is just a parameter, and there is no "good" or "bad" parameter as an absolute concept.

I, personally, keep measuring avast (or any other security tool for that matter) according to my needs, my own experience with it, and as I mentioned I'd rather always have avast detecting first hand (so please keep improving, always, on that aspect) than cleaning (which comes later in the security steps). More important than one test, is what happens in "real life" during longer periods of time.
ADD/REMOVE PROGS -> avast -> CHANGE/REMOVE -> REPAIR & REBOOT
Avast! 7 FAQ | FAQ & KB | Docs | Removal Utils | Configure Mail Shield | report FP | License Registration | UNSECURED?

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re: Terrible results in Removal Tests
« Reply #6 on: December 15, 2011, 05:10:23 PM »
It does not show the real world. Ok.
But avast need to improve its cleaning capabilities or develop an specialized tool for that.
Easy to say. Hard to do. I know.
The best things in life are free.

Offline Gargamel360

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2346
  • Memento Mori
Re: Terrible results in Removal Tests
« Reply #7 on: December 15, 2011, 05:16:18 PM »
This more or less reflects what I have experienced myself with Avast!.  I've tried ~3-4 times over last couple of years to install Avast! on an infected PC, none of those times played out very well.  

It has seems they operate more or less along the lines of "Prevention is Better than a Cure", a wisdom I can't argue with.  

Still....bottom of yet another test.....not the best publicity, many will do what they always have, treat AV comparatives like the gospel, pay attention to the colored bar graphs rather than the methodology.

But avast need to improve its cleaning capabilities or develop an specialized tool for that.
Well, there is a rescue disc.  Unless you meant free tool.
Signature?  But I gots no pen....

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re: Terrible results in Removal Tests
« Reply #8 on: December 15, 2011, 05:54:17 PM »
Well, there is a rescue disc.  Unless you meant free tool.
Well, do you really think the Rescue disk cleaning capability is *that* higher of the installed version?
The best things in life are free.

Offline Gargamel360

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2346
  • Memento Mori
Re: Terrible results in Removal Tests
« Reply #9 on: December 15, 2011, 06:03:12 PM »
Well, do you really think the Rescue disk cleaning capability is *that* higher of the installed version?
Its sole advantage is its medium, being a disc, it operates from outside Windows instead of within.

I'm taking it by "cleaning capability" you are not referring to cleaning an infected file, but detection/quarantine/deletion of an infection in general?
Signature?  But I gots no pen....

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re: Terrible results in Removal Tests
« Reply #10 on: December 15, 2011, 07:10:35 PM »
I'm taking it by "cleaning capability" you are not referring to cleaning an infected file, but detection/quarantine/deletion of an infection in general?
Detection/quarantine/deletion of files, related files, registry keys, links, rootkits, temporary files.
The best things in life are free.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40610
  • Dragons by Sasha
    • Malware fixes
Re: Terrible results in Removal Tests
« Reply #11 on: December 15, 2011, 09:08:25 PM »
Although avast could improve the cleaning capabilities, I'd rather always put the priority in detection first.

There are other tools for cleaning, and even better than that, users that are specialist on cleaning malware (with logic, knowledge and brain).

Those tools targeting cleaning aspects are a complement to avast detecting capabilities.

So, from my point of view, the test is just one additional parameter. I don't question how "valid" or "close to reality" the test is. It is just a parameter, and there is no "good" or "bad" parameter as an absolute concept.

I, personally, keep measuring avast (or any other security tool for that matter) according to my needs, my own experience with it, and as I mentioned I'd rather always have avast detecting first hand (so please keep improving, always, on that aspect) than cleaning (which comes later in the security steps). More important than one test, is what happens in "real life" during longer periods of time.
When Avast is installed on an infected computer it may not clean it all, but and here is the best part - it stops the processes from accessing the net to get some friends in... 

Offline dagrev

  • Poster
  • *
  • Posts: 424
Re: Terrible results in Removal Tests
« Reply #12 on: December 15, 2011, 11:36:44 PM »
Detection and prevention is clearly better.  Yet Avast has done very poorly in initial detections as well recently (last recently). This was admitted by Vlk (in another thread I started) and that avast has some work to do to improve those results.  No excuses or candy coating it from him, which I admire.  Whatever quibbles we have with various tests when Avast admits they are lagging, they are lagging.
Toshiba P870 Intel i7 2.30 GHz, 8GB Ram / Win7 (x64) SP1 | AIS 8 | MBAM Pro | AX64 Time Machine | Acronis TI | iDrive (free) | Pale Moon Browser
Naturalism postulates a non-rational source for man’s rationality. (K.Samples)
Would any one trust in the convictions of a monkey’s mind...? (Darwin)

Offline SpeedyPC

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3349
  • Avast shall conquer the whole world
Re: Terrible results in Removal Tests
« Reply #13 on: December 16, 2011, 04:22:22 AM »
It does not show the real world. Ok.
But avast need to improve its cleaning capabilities or develop an specialized tool for that.
Easy to say. Hard to do. I know.

That worries me if Avast doesn't improve on cleaning capabilities or develop an specialized tool for that, I'm stuck with Comodo Cleaning Essentials (CCE) which its free and it not an FW & AV software it a cleaning tool and you'll have to be extra careful otherwise it can lead to false positives :-\ :'( :'( :'(

I'm not very happy about this so what can I do, I don't mind walking up to Vlk or Igor and belt them with a baseball bat to give them a bloody huge wake up call ;D
« Last Edit: December 16, 2011, 05:24:39 AM by SpeedyPC »
ASUS G75VX-T4153H | Avast Premium v21.9.2493 | Avast SecureLine VPN | Avast Secure Browser | Avast Driver Updater | Avast BreachGuard | W8.1 64bit | Firefox 64bit | Thunderbird 64bit | MBAM Premium | Adguard Premium | CryptoPrevent Premium | CCleaner Portable | MCShield | Macrium Reflect | 7-Zip

Offline True Indian

  • Malware Hunter
  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 710
  • A Good Old Indian!
Re: Terrible results in Removal Tests
« Reply #14 on: December 16, 2011, 07:34:05 AM »
avast has been doing excellent in my removal tests though i infect a VM with over some trojans fakeAV worms a rootkit

and it always removes all of them what is left behind is ignorable adware...not a problrm at all  ;D

i think the test done by av-comparatives has a very small amount of malware sample to test with as to what i see in their report...who knows if these guys are being paid for the results by some av vendors  :P