Terrible results in Removal Tests

[avastfan18]

http://av-comparatives.org/images/stories/test/removal/avc_removal_2011.pdf
Avast! is LAST
You should improve disinfection avast team!

[DavidR]

I have to say I'm not impressed by this, not by  the poor cleaning of the samples by avast but by the test itself.

To me reading the Test-Proceedure and malware selection, it just doesn't mirror real world use.

First infecting a system under the Administrator account with no AV present; it has to be a malware dropper that the AVs on-demand/on-access scanner already detects; then install the AV.

To me that is crazy, the whole point of an on-access AV is to prevent infection, so if it can detects the dropper in the first place it would prevent the infection, rendering the cleaning process redundant.

[avastfan18]

I have to say I'm not impressed by this, not by  the poor cleaning of the samples by avast but by the test itself.

To me reading the Test-Proceedure and malware selection, it just doesn't mirror real world use.

First infecting a system under the Administrator account with no AV present; it has to be a malware dropper that the AVs on-demand/on-access scanner already detects; then install the AV.

To me that is crazy, the whole point of an on-access AV is to prevent infection, so if it can detects the dropper in the first place it would prevent the infection, rendering the cleaning process redundant.

I agree with you - it's weird... BUT... when someone with infected PC installs avast! then Avast! fails because it has poor cleaning process.
So really avast! should improve cleaning process.

[polonus]

Hi DavidR,

Does not surprise me one bit either. No resemblance to the real world theater. Made to suit the workings of certain av solutions better than others. It reminds me of the mythical story of Procustos bed. Everyone was made to fit in a very painful manner. Only those that fit the bed did not suffer.

polonus

[DavidR]

<snip quote>

I agree with you - it's weird... BUT... when someone with infected PC installs avast! then Avast! fails because it has poor cleaning process.
So really avast! should improve cleaning process.

Well when running a system without any AV, the users is playing Russian roulette and has to take some responsibility for the consequences of their action/inaction.

In a perfect world, yes it would be nice if they could clean all infections present on the system at the time of installation, but that may not always be possible. We do however, see many instances in the viruses and worms forum, where avast does just that, but that isn't 100%.

[ady4um]

Although avast could improve the cleaning capabilities, I'd rather always put the priority in detection first.

There are other tools for cleaning, and even better than that, users that are specialist on cleaning malware (with logic, knowledge and brain).

Those tools targeting cleaning aspects are a complement to avast detecting capabilities.

So, from my point of view, the test is just one additional parameter. I don't question how "valid" or "close to reality" the test is. It is just a parameter, and there is no "good" or "bad" parameter as an absolute concept.

I, personally, keep measuring avast (or any other security tool for that matter) according to my needs, my own experience with it, and as I mentioned I'd rather always have avast detecting first hand (so please keep improving, always, on that aspect) than cleaning (which comes later in the security steps). More important than one test, is what happens in "real life" during longer periods of time.

[Lisandro]

It does not show the real world. Ok.
But avast need to improve its cleaning capabilities or develop an specialized tool for that.
Easy to say. Hard to do. I know.

[Gargamel360]

This more or less reflects what I have experienced myself with Avast!.  I've tried ~3-4 times over last couple of years to install Avast! on an infected PC, none of those times played out very well.  

It has seems they operate more or less along the lines of "Prevention is Better than a Cure", a wisdom I can't argue with.  

Still....bottom of yet another test.....not the best publicity, many will do what they always have, treat AV comparatives like the gospel, pay attention to the colored bar graphs rather than the methodology.

But avast need to improve its cleaning capabilities or develop an specialized tool for that.

Well, there is a rescue disc.  Unless you meant free tool.

[Lisandro]

Well, there is a rescue disc.  Unless you meant free tool.

Well, do you really think the Rescue disk cleaning capability is *that* higher of the installed version?

[Gargamel360]

Well, do you really think the Rescue disk cleaning capability is *that* higher of the installed version?

Its sole advantage is its medium, being a disc, it operates from outside Windows instead of within.

I'm taking it by "cleaning capability" you are not referring to cleaning an infected file, but detection/quarantine/deletion of an infection in general?

[Lisandro]

I'm taking it by "cleaning capability" you are not referring to cleaning an infected file, but detection/quarantine/deletion of an infection in general?

Detection/quarantine/deletion of files, related files, registry keys, links, rootkits, temporary files.

[essexboy]

Although avast could improve the cleaning capabilities, I'd rather always put the priority in detection first.

There are other tools for cleaning, and even better than that, users that are specialist on cleaning malware (with logic, knowledge and brain).

Those tools targeting cleaning aspects are a complement to avast detecting capabilities.

So, from my point of view, the test is just one additional parameter. I don't question how "valid" or "close to reality" the test is. It is just a parameter, and there is no "good" or "bad" parameter as an absolute concept.

I, personally, keep measuring avast (or any other security tool for that matter) according to my needs, my own experience with it, and as I mentioned I'd rather always have avast detecting first hand (so please keep improving, always, on that aspect) than cleaning (which comes later in the security steps). More important than one test, is what happens in "real life" during longer periods of time.

When Avast is installed on an infected computer it may not clean it all, but and here is the best part - it stops the processes from accessing the net to get some friends in... 

[dagrev]

Detection and prevention is clearly better.  Yet Avast has done very poorly in initial detections as well recently (last recently). This was admitted by Vlk (in another thread I started) and that avast has some work to do to improve those results.  No excuses or candy coating it from him, which I admire.  Whatever quibbles we have with various tests when Avast admits they are lagging, they are lagging.

[SpeedyPC]

It does not show the real world. Ok.
But avast need to improve its cleaning capabilities or develop an specialized tool for that.
Easy to say. Hard to do. I know.

That worries me if Avast doesn't improve on cleaning capabilities or develop an specialized tool for that, I'm stuck with Comodo Cleaning Essentials (CCE) which its free and it not an FW & AV software it a cleaning tool and you'll have to be extra careful otherwise it can lead to false positives :'( :'( :'(

I'm not very happy about this so what can I do, I don't mind walking up to Vlk or Igor and belt them with a baseball bat to give them a bloody huge wake up call

[true indian]

avast has been doing excellent in my removal tests though i infect a VM with over some trojans fakeAV worms a rootkit

and it always removes all of them what is left behind is ignorable adware...not a problrm at all 

i think the test done by av-comparatives has a very small amount of malware sample to test with as to what i see in their report...who knows if these guys are being paid for the results by some av vendors