Comparison Test of Anti-Virus-Software 2001-10 (Client products) of the
University of Magdeburg and GEGA IT-Solutions GbR (http://www.av-test.org)
Copyright (c) 2001 Andreas Marx <amarx@gega-it.de>

Last update: 2001-11-19 (Data: 2001-11-09)


Hint (2001-11-05): The test of the virus detection was performed using the
WildList 08/2001 (not including Win32/Bady.C, because it is not a virus).

Hint (2001-11-16): To reduce the complexity of the XLS sheet and the online
(HTML) version we have decided to include the different Zoo virus detection
scores for different OS platforms only in this comment file, but not in the
main XLS sheet. For the values that can be found in the XLS sheet, we used
the worser detection score for viruses and the higher false positive score.
Differences in the detection of the more important ITW viruses are however
directly visible in the XLS sheet.


AVIR-98, -ME, -XH (Test 2001-10) and
AVIR-NT, -2K, -XP (Test 2001-11)
H+BEDV Datentechnik
AntiVir Personal Edition

Comments:
- Free of charge for personal, non-commercial use, but the Freeware edition
  cannot scan network drives (download: www.free-av.com)
- AntiVir can create very detailed report files
- The first version we got caused blue screens under Windows 98 if a file
  or macro virus has been found (guard only) and the version was unable to
  find boot viruses on-access; quickly after our notification we got an
  updated version which solved the problem
- The tested NT-based version did not had a virus guard for Windows XP,
  therefore we've tested the XP guard with a new version we got on the
  official XP release date
- The virus detection was different for Windows 98/ME vs. NT/2000/XP

Missed ITW viruses (Windows 98 and ME):
- On-Demand: W97M/Ostrich.B (2x)
- On-Access: W97M/Service.A (2x)

Missed ITW viruses (Windows NT, 2000 and XP):
- On-Demand and On-Access: W97M/Ostrich.B (2x)


AVGS-98, -ME, -XH (Test 2001-10) and
AVGS-NT, -2K, -XP (Test 2001-11)
Grisoft, Jakob Software
AVG

Comments:
- In many countries the product can be obtained as free-of-charge version
  for personal use, but without any support (download: www.grisoft.com)
- Includes two different GUI versions: A basic one for beginners and an
  advanced one for power users
- Differences on Zoo virus detection which are not listed in the XLS sheet:
  Polymorphic Win32 viruses: 885 will be found under Windows 98/ME/NT/2000,
  but under Windows XP only 848 viruses will be found; Backdoor detection:
  856 files will be identified under Windows 98/ME/NT/2000, but under XP
  only 742 backdoors will be identified
- The virus detection was different for Win 98 vs. ME vs. NT/2000 vs. XP

Missed ITW viruses (Windows 98):
- On-Demand and On-Access: JS/Kak.A (1x HTA)

Missed ITW viruses (Windows ME):
- On-Demand and On-Access: Win32/Kriz.4029 (2x), Win32/Kriz.4050 (2x),
  Win32/Magistr.A (2x), Win32/Weird.10240 (1x), JS/Kak.A (1x HTA)

Missed ITW viruses (Windows NT, 2000 and XP):
- On-Demand: JS/Kak.A (1x HTA)
- On-Access: O/A: JS/Kak.A (1x HTA), Michelangelo.A (2x)


AVKI-98, -ME, -XH (Test 2001-10) and
AVKI-NT, -2K, -XP (Test 2001-11)
G Data
AntiVirenKit (Beta)

Comments:
- We have tested a Beta version on request of the developers
- Program uses two search engines (both on-demand and on-access):
  Kaspersky and RAV (Reliable Anti-Virus)
- The first Windows NT version we got for testing always crashed Windows
  if a virus-infected file was access (guard problem), but after we got a
  fix the problem was solved
- For the Windows 2000 platform we needed three patches: The first one
  crashed Windows directly after the installation was finished, the second
  version crashed if a virus-infected file was access (guard problem), but
  the third version was running fine
- The guard of the tested Windows XP version does not block access to
  infected files all of the times, therefore, no tests for file, macro and
  script viruses were possible
- The virus detection was different for Win 98/ME vs. NT/2000/XP

Missed ITW viruses (Windows NT, 2000 and XP):
- On-Access: Michelangelo.A


AVXP-98, -ME, -XH (Test 2001-10) and
AVXP-NT, -2K, -XP (Test 2001-11)
Softwin, Central Command
Anti-Virus eXpert Prof.

Comments:
- AVX is not only a virus scanner, it includes a Personal Firewall, too
  (during installation it can be selected, if only the virus scanner should
  be installed or the complete package)
- The program does not run correctly on fast Athlon processor, like on a
  few of our 1,33 GHz systems (the program causes a lot of crashes)
- The on-demand virus scanner crashed on all operating systems on the
  Backdoor collection and also a few times on the XM part of the macro
  virus collection, if the option "open packed programs" was selected - we
  got a fix quickly that corrected the problem (updated upx.dll)
- Boot virus infections will be found correctly, however, no report will
  be generated and for the statistic these findings will also not counted
- Differences on Zoo virus detection which are not listed in the XLS sheet:
  Under Windows 98/ME 618 backdoors will be identified, but under NT-based
  systems like NT/2000/XP the detection score was 641
- The virus detection was different for Win 98/ME vs. NT/2000/XP

Missed ITW viruses (all platforms):
- On-Demand and On-Access: Win32/MTX.A (1x)


CSAV-98, -ME, -XH (Test 2001-10) and
CSAV-NT, -2K, -XP (Test 2001-11)
Command Software
Command Anti-Virus

Comments:
- For the test we got different installation versions of the program for
  all platforms: We used a German version 4.62.4 (dated 2001-02-01) and a
  special patch for Windows 98, ME and NT; the test on the 2000 and XP
  platforms were performed using an English 4.63.0 version (dated
  2001-08-14) and an additional patch - this is likely the reason for
  different detection scores in the Zoo detection test
- Differences on Zoo virus detection which are not listed in the XLS sheet:
  Under Windows 98/ME 360 BAT script viruses were detected, but only 359
  on the NT/2000/XP platform; under Windows 98/ME/NT/2000 the program has
  detected 542 VBS script viruses, but under XP it has identified 543 files
  as being infected
- The virus detection was different for Win 98/ME vs. NT/2000 vs. XP

Missed ITW viruses (all platforms):
- (None)


DWEB-98, -ME, -XH (Test 2001-10) and
DWEB-NT, -2K, -XP (Test 2001-11)
Igor Daniloff
Dr. Web

Comments:
- Very small program (requires 2,25 MB disk space only)
- To change settings (scanner and guard) the program requires a reboot,
  however, on some options the program does not tell that it will now
  requires a reboot
- The results of the on-demand virus scan will be displayed at the bottom
  of the main program window only (both infected and scanned files), but
  not, what these numbers represent; a more detailed statistic is not
  available
- It seems to be that the program has a bug on detection of WM macro
  viruses - under all platforms the detection scores were very low (63%)
- No virus detection differences (same results on all platforms)

Missed ITW viruses (all platforms):
- (None)


ETRE-98, -ME, -XH (Test 2001-10) and
ETRE-NT, -2K, -XP (Test 2001-11)
Computer Associates
eTrust EZ Anti-Virus

Comments:
- Program was formerly known as InoculateIT Personal Edition
- Uses the VET scan engine
- By design, the program does not scan network drives
- To activate or deactivate the guard, the computer has to be rebooted
- No virus guard was available for Windows XP during the time we've tested
  the software, but according to the developers it will be available at
  the time, where the test is published
- Archived and compressed files: The program reports a "unable to open
  file - not scanned" in the case of password protected archive files only,
  but no reason, therefore it got an "-"
- No virus detection differences (same results on all platforms)

Missed ITW viruses (all platforms):
- (None)


ETRI-98, -ME, -XH (Test 2001-10) and
ETRI-NT, -2K, -XP (Test 2001-11)
Computer Associates
eTrust InoculateIT

Comments:
- The program has two scan engines (InoculateIT and VET), however, only one
  of them can be used at the same time, but a different one can be used for
  the on-demand scanner and the on-access guard
- Only the InoculateIT engine was tested - the test results of the VET
  engine can be found under "eTrust EZ Anti-Virus"
- A fix for the on-access miss of Michelangelo.A is under development
- The virus detection was different for Win 98 vs. ME/NT/2000/XP

Missed ITW viruses (Windows 98):
- On-Access: Michelangelo.A (2x)


FPWP-98, -ME, -XH (Test 2001-10) and
FPWP-NT, -2K, -XP (Test 2001-11)
Frisk, perComp
F-Prot for Windows

Comments:
- The guard can be configured under Windows 98 and ME only (but the option
  if a virus is found is always deny access and report) and it is easy to
  activate or deactivate, however, there is no configuration possible for
  the Win NT, 2000 and XP guard - it can only be activated or deactivated
- The virus detection was different for Win 98/ME/XP vs. NT/2000

Missed ITW viruses (Windows NT and 2000):
- On-Access: Monkey.B (2x)


FSAV-98, -ME, -XH (Test 2001-10) and
FSAV-NT, -2K, -XP (Test 2001-11)
F-Secure
Anti-Virus

Comments:
- Program can use two different search engines at the same time under
  Windows 98/ME (F-Prot and Kaspersky), for NT-based systems three search
  engines can be used at the same time (in addition, the heuristic Orion
  engine); this is likely the reason for different test results on these
  platforms
- The Windows 98/ME version is much more instable and slower than the
  NT-based program (esp. if a lot of viruses has been found)
- The archive detection is worser for Win 98/ME in comparison to NT-based
  platforms: Under Windows 98/ME the detection of single and multiple
  packed archives is limited to ARJ, LHA and ZIP as well as ARJ, LHA and
  WinZip for self-extracting SFX archives, but the product for NT-based
  systems can scan inside all of the tested archive formats
- Under Windows NT/2000/XP there is also a slightly better detection of
  embedded OLE objects: Both DOC, PPT and XLS will be found by the scanner
  inside MSO-HTML files, under Windows 98/ME the XLS file will be missed
- Report files will be created as HTML file, including links to the
  online virus database
- The ITW virus Win32/Sircam.A will be missed, because the program do not
  scan for file with the extension "LNK" Sircam uses - currently two
  hotfixes are available for F-Secure AV, but none of them address this
  issue
- Differences on Zoo virus detection which are not listed in the XLS sheet:
  Under Windows 98/ME 1249 backdoors will be identified, but under Windows
  NT/2000/XP the program is able to find 1250 ones; under Win 98/ME FSAV
  is able to find 1364 Trojan Horses, but under NT-based systems 1366 will
  be found; the false positive score for Win 98/ME is 12 and 13 for Win
  NT/2000/XP
- The virus detection was different for Win 98/ME vs. NT/2000/XP

Missed ITW viruses (all platforms):
- On-Demand and On-Access: Win32/Sircam.A (1x LNK)


KASP-98, -ME, -XH (Test 2001-10) and
KASP-NT, -2K, -XP (Test 2001-11)
Kaspersky Lab, Datsec
AV Personal Pro (Beta)

Comments:
- We have tested a Beta version on request of the developers
- By design, the program does not scan network drives
- The user can choose between two GUIs: A "Standard" one for beginners
  (easier to use, for example, only full drives can be scanned) and an
  "Expert Mode" (all scan settings available)
- The configuration and (de-)activation of the guard is a bit tricky for
  beginners: In the "AVP Control Center", a click with the right mouse key
  is needed on the option "Monitor status" to show the configuration tab
- We have reported the problems with the missed ITW boot viruses (both
  on-demand and on-access) to the developers, but we didn't get any
  response yet
- On-Access: The macro viruses PP97M/Tristate.C and PP97M/Tristate.D were
  correctly found and blocked, but they will only be reported, no action
  like delete will be taken
- The virus detection was different for Win 98/ME vs. NT/2000/XP

Missed ITW viruses (Windows 98 and ME):
- On-Access: No boot viruses will be found

Missed ITW viruses (Windows NT, 2000 and XP):
- On-Demand and On-Access: Michelangelo.A (2x)


MKSV-98, -ME, -XH (Test 2001-10) and
MKSV-NT, -2K, -XP (Test 2001-11)
Marek Sell
MKS_VIR

Comments:
- All on-demand boot viruses detections will be reported correctly, but
  they cannot be found in the scan statistic
- No virus detection differences (same results on all platforms)

Missed ITW viruses (all platforms):
- On-Demand: Win32/Blebla.A (1x CHM), Win32/Blebla.B (1x CHM),
  Win32/Sircam.A (1x LNK), PP97M/Tristate.C (2x), PP97M/Tristate.D (2x),
  X97M/Jini.A1 (2x)
- On-Access: PP97M/Tristate.C (2x), PP97M/Tristate.D (2x),
  X97M/Jini.A1 (2x)


NORM-98, -ME, -XH (Test 2001-10) and
NORM-NT, -2K, -XP (Test 2001-11)
Norman
Virus Control

Comments:
- Program creates only encrypted report files, to get useable plain text
  report files, an undocumented function has to be used (we got the hint
  from the German support team); according to Norman, this will be fixed
  in the next program release
- There is no direct "Delete infected files" function
- No central user interface, but a lot of different program parts
- No virus detection differences (same results on all platforms)

Missed ITW viruses (all platforms):
- (None)


NORT-98, -ME, -XH (Test 2001-10) and
NORT-NT, -2K, -XP (Test 2001-11)
Symantec
Norton Anti-Virus 2002

Comments:
- Using optimal program settings (scan all files etc.) the program is very
  slow (applies to all tested operating systems)
- The program has problems to handle big report files correctly, sometimes,
  they cannot be displayed or exported (but no crashes occurred)
- The Windows NT version needs at least Internet Explorer 4.01
- Under Windows XP, an update using the "????x86.exe" update file was not
  possible: The update was copied in the correct directory, but was not
  activated, even if the update program tells the user, that everything
  went ok; LiveUpdate worked fine and the bug is now documented:
  http://www.symantec.com/avcenter/win.xp.defs.support.html
- Differences on Zoo virus detection which are not listed in the XLS sheet:
  The Windows 98/ME/NT/2000 version had 7 false positives, but the XP
  version had only 5 (using exactly the same update)
- The virus detection was different for Win 98/ME/NT/2000 vs. XP

Missed ITW viruses (all platforms):
- (None)


PAND-98, -ME, -XH (Test 2001-10) and
PAND-NT, -2K, -XP (Test 2001-11)
Panda Software
Antivirus Platinum

Comments:
- The program only creates unusable report files (truncated path names),
  but an hidden, undocumented file c:\panda.rpt will be created on the PC
  which contains the full path and file names - we used them instead of
  the report files and screenshots to find out the detection of archived
  and compressed files; according to Panda Software, this will be fixed in
  the next version of the program
- In the tested version 6.23.99 no virus guard was included for Windows XP,
  a few days later we got an updated version 6.25.00 which includes a
  guard and we have tested the on-access detection score under Windows XP
  with this new version using the old virus definition files
- No virus detection differences (same results on all platforms)

Missed ITW viruses (all platforms):
- (None)


PCCI-98, -ME, -XH (Test 2001-10) and
PCCI-NT, -2K, -XP (Test 2001-11)
Trend Micro
PC-cillin 2000

Comments:
- Windows XP: The setup has to be run twice, because on the first run, only
  an error message will be displayed during setup
- On the web site http://www.antivirus.com/pc-cillin/download/pattern.asp
  there was a wrong instruction guide how to update the scan engine and
  pattern file manually, this has been fixed now
- We reported the on-access boot virus detection problem for the Win XP
  platform, the version 5.600 of the scan engine which was available during
  the test process did not solved this issue, but the new version 5.630 we
  could test as Beta version shortly before test result publication solved
  this problem
- Differences on Zoo virus detection which are not listed in the XLS sheet:
  The detection score of Win32 file viruses was 3983 viruses under Windows
  98/ME, but only 3981 under all NT-based platforms
- The virus detection was different for Win 98/ME/2000 vs. NT vs. XP

Missed ITW viruses (Windows NT):
- On-Access: Michelangelo.A (2x)

Missed ITW viruses (Windows XP):
- On-Access: All boot viruses


RAVP-98, -ME, -XH (Test 2001-10) and
RAVP-NT, -2K, -XP (Test 2001-11)
GeCAD
Reliable Anti-Virus (RAV)

Comments:
- Has two user interfaces: A playful one for beginners and an advanced one
  for professional users
- The program runs only under Windows XP without any problems, for all
  other platforms we need fixes for the on-access guard: For Win 98/ME two
  updates of ravmon8.vxd and kernel.vdk were needed and for Windows NT/2000
  one fix for ravcore.sys was needed (the original version caused blue
  screens or other crashes only)
- According to the vendor, the ITW misses of Michelangelo.A are now fixed
  in the current release
- The virus detection was different for Win 98/ME vs. NT/2000/XP

Missed ITW viruses (Windows NT, 2000 and XP):
- On-Access: Michelangelo.A (2x)


SOPH-98, -ME, -XH (Test 2001-10) and
SOPH-NT, -2K, -XP (Test 2001-11)
Sophos
Anti-Virus (Sweep)

Comments:
- Under Windows 98 and ME it is a little bit complicated to deactivate the
  virus guard (in the systray), if needed
- On password-protected OLE files the program often reports first "Fehler:
  Konnte <Dateiname> nicht berprfen. Die Datei ist kennwortgeschtzt."
  (translated: "Error: Could not check <File name>. The file is password-
  protected"), but directly after this message it correctly reports that
  this file is infected by a virus
- No virus detection differences (same results on all platforms)

Missed ITW viruses (all platforms):
- (None)


VSCA-98, -ME, -XH (Test 2001-10) and
VSCA-NT, -2K, -XP (Test 2001-11)
Network Associates
McAfee VirusScan

Comments:
- In the default settings, the on-demand scanner was only able to find 304
  of 410 tested ITW file, script and macro viruses, because extensions
  like "VBS" were missing in the program's extension list - if the option
  "User specified files" or "All files" were selected, all viruses were
  found correctly; the developers reacted quickly and send us an "Extension
  Patch" which will be automatically downloaded during installation and is
  available at: http://www.mcafeeathome.com/naicommon/download/patches.asp
- The program had a lot of problems with report files (called activity
  log) - after about 3000 entries the program always crashed (General
  Protection fault in VSMAIN.EXE) during export to a file or the program
  will not generate any report file (programs shows an empty activity log
  after a scan of a large virus test set) and sometimes (esp. under Win NT)
  we were able to select a folder to save the log file, but this option
  will be ignored and the installation folder of VirusScan will be used
  instead
- Under Windows 98 and ME it seems to be that only disks will be scanned
  on-access for boot viruses, which contains files on it
- Differences on Zoo virus detection which are not listed in the XLS sheet:
  The test results of the program varies in four categories, they are
  different for Windows 98, ME, NT and 2000 in comparison to XP on X97M
  macro viruses (2446 vs. 2448), BAT script viruses (379 vs. 380), Win32
  polymorphic viruses (1137 vs. 1139) and Backdoors (1242 vs. 1243)
- The virus detection was different for Win 98/ME vs. NT/2000 vs. XP

Missed ITW viruses (Windows 98 and ME):
- On-Demand: Michelangelo.A (2x)
- On-Access: Empire.Monkey.B (2x), Form.A (2x), J&M.A (2x), Junkie.A (2x),
  Parity_Boot.B (2x), Ripper.A (2x), Stoned.Noint.A (2x)

Missed ITW viruses (Windows NT, 2000 and XP):
- On-Demand: Michelangelo.A (2x)


VSCC-98, -ME, -XH (Test 2001-10) and
VSCC-NT, -2K, -XP (Test 2001-11)
Network Associates
VirusScan Corporate

Comments:
- We used version 4.51 and a Beta version of the Service Pack 1 on request
  of the developers
- Differences on Zoo virus detection which are not listed in the XLS sheet:
  Under Windows 98/ME the program was able to detect 1358 Trojan Horses,
  but under Windows NT/2000/XP only 1357 files were correctly identified
- The virus detection was different for Win 98/ME vs. NT/2000/XP

Missed ITW viruses (all platforms):
- (None)


### END OF FILE ###
