Let's say we have 49 instances of current malware, which are 100% known to antiviruses with modern databases. And what could these antiviruses do with them a week ago, when these malware had not yet fallen into the hands of virus analysts? How effective is the heuristic and proactive protection of modern internet security, if you test it against real malware? And for this you don’t need to invent a time machine at all - we’ll just preserve the experimental antiviruses in virtual machines without access to the Internet, and in a week we will check them for the collection of the latest malware, which is already detected by these antiviruses with up-to-date databases. But the antiviruses of the past, of course, do not yet know about this :).
We will use KIS, Dr.Web, ESET and Windows Defender as guinea pigs. All except the last one will run in Win 7. The latter will run under Win 10 - there is hope that the "ten" is better protected and even with such a sieve as Defender, viruses will not pass. Well, let's check.
More about testing
Here is what will be checked: virus detection, virus launch blocking and infection treatment. The first test will be performed with disabled protection - in scanner mode. For the second and third tests, the antivirus monitor will be enabled.
After all this, we will update the databases and compare the received detection with the previous result. Since there are many viruses, the “exhibits” for checking the launch will be selected by the antivirus itself. Let's run those viruses that will not be removed as a result of the detection test. It is foolish to try to launch a virus that is in the anti-virus database - any anti-virus will block it. The most interesting thing is to launch a virus that is "unfamiliar" to the antivirus.
All viruses in my collection were divided into groups: Backdoor, Worm, Virus, and so on. Later, a list of all the "heroes of the program" will be given. As you can see, there are plenty to choose from.
Your ideas
Your ideas inspire us to new research. We have already taken them into account. So keep gushing - comments on the article are always open for your rationalization proposals :).
All operating systems are fresh (specially installed for this article), and the Internet was turned off immediately after installing the antivirus, so that the databases with a 100% guarantee remain old.
Let's start testing with the well-known Kaspersky Internet Security. As you can see from the screenshot below, the antivirus was installed six days ago (24 days of free use left).
Disable the antivirus, unpack the archive with viruses. We do not activate the anti-virus, but we run a selective scan (so that it does not run everything in a row, but concentrates on one folder) and checks the Virus folder. I remember once they managed to pour 23 liters into a 20-liter canister at a gas station. So in the case of Kaspersky - in a folder of 49 files, he managed to find 80!
Apparently, several infections are packed into one file and the antivirus reflects each of them separately in the list. Let's see the detailed report.
As can be seen from the screen, 45 threats were found (out of 49). For some reason, the Trojan.Win32.Waldek.jsu virus was neither removed nor quarantined: the antivirus simply did not process it, although it detected it. There are 11 files left in the Virus folder.
Most viruses survived in the RansomWare folder. As you can see from the screenshot, the antivirus did not touch files with numbers 2, 4, 7 and 8 at all. It will be interesting to look at the detection after updating the databases.
Well, now we activate the protection and try to launch the "surviving" viruses from the Virus folder. I ran the first two files from the RansomWare folder (numbers 2 and 4). File number 2 was recognized as PDM:Trojan.Win32.Generic. The anti-virus detected a dangerous behavior of the program, "accurately characterizing it as malicious."
Suggested to heal the computer with reboot. We agree. Treatment began, the antivirus canceled the actions of the malicious program and simultaneously eliminated file number 4.
I did not like the results of the treatment. After reboot I didn't get clean system. Something was trying to boot, there were files created by the virus on the desktop. The antivirus cleaned up something, but it seems to me that not all. Along the way, the antivirus, of course, tries to treat objects created by viruses.
I continue to run files from the RansomWare folder (numbers 7 and 8). Immediately after launching these files, as in the previous case, there was no immediate reaction from the antivirus, which allows programs to multiply. The antivirus began to react after the viruses tried to send emails. Nothing worked out for them - I didn't mail client, no internet connection!
Interestingly, Kaspersky Anti-Virus did not react to file number 8. Go ahead. From the Scareware subfolder, I launch a single file with the same name. I'm waiting a few minutes. There is no reaction from the antivirus, and in the meantime the virus, most likely, is doing its dark deeds.
From the TrojanCryptor folder, I launch a file named TrojanCryptor (1). Cryptographer - heavy artillery. There was also no reaction from the antivirus. But a window appeared.
About the ransomware
The Trojan started, there seemed to be no reaction from the antivirus, but the data remained unencrypted, as was the case with another participant in this test. But one of the antiviruses allowed data encryption, as you will see below.
From the Virus folder I launch files with numbers 4 and 8, then from the Worm folder - files 6 and 8. For some reason, the first one did not start (not only developers of conventional programs make mistakes, but also virus writers). And the second Kaspersky did not react in any way.
I'm running a full computer scan. Its purpose is to identify virus-infected objects and try to cure the computer. After the reboot, let's see what happened with the antivirus. Frankly, the results did not please me. The antivirus reported that no threats were detected. Although malware left on the computer. I didn't dig deep - I just opened msconfig and looked at the startup list. As you can see, the antivirus cleaned far from everything.
When I restarted my computer, Kaspersky reported that he decided to cure my computer - detected active process treatment, as a result of which the Ransomware (8).exe file was deleted, as well as the worm (8).exe file.
It looks like it cleaned out some malicious files. After curing an active infection, KIS again reported that there were no threats.
Well, it's time to update the database. Databases updated, computer restarted. After the reboot, the recovery after infection wizard started, offering to fix some points. After the wizard is done, I restart the computer again.
The master restored some things, but not some. Yes, autorun is cleared. But not completely - as you can see, there are still those who want to start. The -!RecOveR!* files created all over the drive weren't deleted either.
I give the antivirus another chance and again run a full scan - this time with new databases. No threats were detected, multiple files created by the virus remained on the computer.
Now repeat the detection test. I disable protection, unpack the archive and run a custom scan of the Virus folder. After updating the databases, Kaspersky neutralized all threats (49). In general, which was to be expected, because we specifically included in the test only real malware known to “antiviruses of the future”.
Dr.Web Security Space
A real monster was chosen in the Dr.Web line, setup file which weighs 466 MB - Security Space. The more compact Katana product didn't fit because it doesn't have a scanner.
Continued available to members only
Option 1. Join the "site" community to read all the materials on the site
Membership in the community during the specified period will give you access to ALL Hacker materials, increase your personal cumulative discount and allow you to accumulate a professional Xakep Score rating!
To the question of Dr. Web or Kaspersky - which is better? given by the author Irene the best answer is Dr. Web or Kaspersky - which is better?
Due to the absolute unsuitability of the free Avast antivirus, which I have been using for the past two years, I decided to switch to paid domestic products: I purchased the Kaspersky Internet Security 2010 antivirus kit (License for 2 PCs) and Dr. Web Security Space Pro 6 (License 2 PC for 2 years) in a box. Dr. Web installed on laptops for himself and his wife, and installed Kaspersky on a desktop computer. To fully appreciate their professional qualities (protection against intrusions and real catching of viruses), you need to live with them for a year or two, while I am ready to talk only about obvious differences and features.
Kaspersky Internet Security 2010 (KIS)
Kaspersky products are well promoted, antivirus and Intermet Security are designed for ordinary users with an average degree of paranoia. Kaspersky is suitable for those who are "annoyed" over the next three to four days to set rules and permissions in the firewall, as well as add applications to "trusted". KIS is the best option for those who want to quickly install protection on their computer and never think about it again.
The Kaspersky wrapper looks smarter (both the website and the KIS software interface). The interface has a magic "Fix Problem" button that you can mindlessly click every time there is some kind of trouble, and the trouble disappears. Despite its beauty, the interface seemed overloaded to me: a lot of non-obvious buttons, active areas and hyperlinks.
The process of forming the KIS anti-virus database is more transparent for the user (on the site you can see who, when and how many viruses were added to the database over the past 24 hours).
Among the features of KIS, I liked the following:
Search for system vulnerabilities and automatic fix(disabling booting from removable media, clearing browser cache and cookies, fixing hosts file, trusted domains, etc.)
Checking programs for vulnerabilities: the system shows which programs have "holes" and gives recommendations on what updates and patches to install
Virtual Keyboard: Useful for entering passwords bypassing keyloggers.
Button "Fix the problem", unloading the brain
Dr. Web Security Space Pro
It seemed to me that the target audience of Doctor Web products are advanced users, programmers and system administrators. Installing complex protection is quite tedious. After installing Security Space Pro, I had to spend a lot of time in order to allow access to the network for all applications that I use, and to prohibit all unwanted applications from external and internal connections.
The design of the software product looks good, but the design of the site is at the level of the sites of the late 90s.
While Kaspersky was certified for the "Compatible with Windows 7" label, Dr. Web received two dozen certificates and approvals from the FSB, the Ministry of Defense, the FSTEC and other government organizations, which cannot but impress.
If we compare the Dr. Web and Kaspersky, then the first one does not have an interface as such. There is only a settings panel that opens when you click on the spider icon in the system tray.
Price
On ozon.ru, Kaspersky Internet Security 2010 for 1 year/2 PCs costs 1520 rubles, Dr. Web Security Space Pro for 2 years / 2 PCs costs 1500 rubles. It turns out that the Web costs half as much, although it essentially has all the same protection modules: firewall, antivirus, proactive defense, spam filter, and parental control. The Web does not have, perhaps, a virtual keyboard.
It so happened that I bought Kaspersky on Softkey.ru, and Doctor Web on ozon.ru. From the soft key, they sent me only an activation key by email and “thank you”, and from ozon.ru - a box with two paper certificates, a disk, a sticker on the computer and a user manual. The boxed version of the Web looks more attractive than a simple activation key for Kaspersky (of course, you could go to the store and buy a box with Kaspersky, but I didn’t go).
What I chose Dr. web
Source:
Answer from Fuck in your mouth[guru]
kaspersky is better but it eats a lot of RAM
Answer from Vitaly[guru]
DR Web is better!
But they are both weak
Vibiray or NOD32 or AVAST
Answer from Alchemist[guru]
Whoever has him, who has Casper for that Casper is the best, and so on 🙂
Answer from Ball_of_Mud[active]
everyone has their own preferences). Wed is a great thing
Answer from DEiMON kUtSEPAlOFF[guru]
Listen - Kaspersky is one hundred percent better - and Dr. Web is complete bullshit - Kaspersky has more virus searches than this fucking doctor - in short, Kaspersky rules
Answer from Vyacheslav Valentinovich[guru]
Both are decent products. As for the landing of the system - it's all a lie. I have both and they work just fine. I have XP and PC. mediocre, total RAM - 2 gigabytes. The system was not planted. But don't put Nod32 - you'll regret it later, it's full of holes like a sieve.
Answer from Vladimir Zernov[guru]
Casper is fine, the other web system is gloomy, the node passes viruses
Answer from Nicholas[guru]
Dr.Web CureIt!® healing utility
Answer from Fail007 Musaev Fail Fagan[newbie]
I had a case where a trojan beacon 1 got on my computer, scanned the system with kaspersky, but it did not find anything. Then I go to the opera, but it doesn’t open a single site, it’s the same in chrome and mozilla. Downloaded Dr. web curate he found two trojans, now I demolished kaspersky and installed dr. web
Answer from Yeamin Mammadov[newbie]
I used Kaspersky, for about 2 years I thought an excellent antivirus was the best. One time I had a case got on my computer, trojan beacon 1, scanned the system with kaspersky, but it didn't find anything. Then I go to the opera, but it doesn’t open a single site, it’s the same in chrome and mozilla. Downloaded Dr. web curate he found two trojans, but did not remove them, downloaded the non-installing ZemanaAntiMalware utility and he found 110 infected files and deleted them now everything works for me. Conclusion: there is no better antivirus; everyone has weaknesses.
Answer from Danil Krokolev[newbie]
Kaspersky Not bad. Especially Total Security 2016. But there is one thing. My computer was lagging terribly and I decided to run a virus scan. Scanned for viruses Kaspersky found 9 viruses. I deleted them, then ran Dr.Web for a scan, 40+ more viruses were found. Then my computer breathed a sigh of relief.
Here is a small test and comparison of four flagships in anti-virus protection - ESET Smart Security 4.2.71.3, Dr.Web Security Space 6.00.1, Kaspersky Internet Security 2011 11.0.2.556, Norton Internet Security 2011 18.5.0.125.
For testing, 4 identical copies were selected according to their "stuffing" of the Windows XP SP3 operating system with all updates at the time of publication of the article. This made it possible to make the most accurate comparison of antivirus products. Let's look at some interesting results.
Starting the system. The following test was carried out: first, the operating system startup time was recorded without an installed antivirus, and then a comparison was made with the system startup speed with each antivirus product separately.
Browser launch. The test was made according to a similar procedure. Based on Opera browser 11.00.1156 International Final. The result fixes the program opening time (do not confuse the program opening time with a fully loaded web page!).
Unpacking the archive. The test shows how long it takes a system with installed antivirus to unpack the archive. For the test we used WinRAR 4.00 Beta 4, which packed 1 file of 510 MB.
Examination system disk. Each antivirus scanned the system disk, the files of which occupied approximately 4.5 GB. The maximum settings of antivirus products were used.
As you can see, in terms of speed, ESET won in three out of four tests. In the speed of scanning the system, Norton won.
Consider another interesting point - the load on the PC. Let's compare how much memory each antivirus product takes up during idle time (when nothing happens on the PC) and during scanning of the aforementioned system disk.
And then again breaks into the lead ESET- it used approximately 60-65 MB of memory during idle and during scanning.
Someone who disappointed - so it is Dr. Web. While idle, it used 105-110 MB (!), and that's just the kernel itself!
To scan the system drive, Dr.Web uses a separate module - Dr.Web Scanner. A single module used an additional 100 MB of memory. Together with the kernel, more than 200 MB of memory is obtained - too much, you see.
Kaspersky Internet Security 2011, which is considered by many to be a "monster" for weak PCs, showed a double result. In idle mode, it took almost the same amount as ESET - 60-65 MB.
But during scanning, Kaspersky is really a "monster" - 150-170 MB of memory
Norton Internet Security 2011 showed good results. During idle time kept at the level of 60-65 MB.
And during scanning - 80-85 MB, which personally surprised me.
In total, ESET Smart Security confidently climbed to the first place, and Norton Internet Security was located not far from it. Of course, Dr.Web disappointed... With a fairly high level of protection, the product uses a lot of PC resources, and the time it took to scan the system drive took 3 times longer than the third best result. Kaspersky Internet Security 2011, at high scanning speed (which is nice), used an indecent amount of memory during system disk scanning compared to other products.
In the end, I would like to note that these results do not confirm or refute the quality of protection against malicious objects and other threats!
Since the advent of the first operating Windows systems issues related to the protection of computers and networks from all kinds of virus threats have become very acute, since most of the known viruses (both then and today) are mainly designed to defeat exactly the operating systems developed by Microsoft. But what exactly to choose for security? Next, we will consider two main and competing Russian antiviruses and try to find out which is better - Doctor Web or Kaspersky. Both developers have made themselves known in the security software market for a long time and are rightfully considered to be among the leaders in the world. However, the opinions of users and specialists in matters of preference or inclination to install any one software product are clearly divided. Let's try to compare some of them, taking into account such reviews.
Which is better - Kaspersky or Doctor Web? What to build on when comparing?
To begin with, each user must learn that both developers release a lot of antivirus software products designed for completely different situations. Among all that can be found, the most popular are regular antiviruses installed directly in OS on local computers, servers or network terminals, portable programs designed to neutralize threats on already infected computers, and special disk utilities that have their own bootloaders to start instead of starting the OS in order to destroy threats in cases where Windows does not boot just due to virus exposure.
Let's briefly dwell on all three types of applications, and also, as comparative characteristics, consider the acquisition of licensed software, the complexity of installation and use, the load on system resources and the quality of security.
Comparison of Kaspersky and Doctor Web: cost and installation issues
As for free regular software products, both developers practically do not have them.
The only exception is the latest modification of the free Kaspersky Anti-Virus (and then it must be activated in a timely manner). Doctor Web does not have this at all. The first round is for Kaspersky. All portable programs and disk applications are really free. But if you buy legal versions of official antiviruses, in fact, it turns out that Doctor Web's software products cost home users and corporate users almost half as much as similar developments from Kaspersky Lab. You can't argue here.
But which antivirus is better from standard tools - Kaspersky or Doctor Web? For installation questions software there is no consensus of this type among specialists or users.
Some people think that installing Doctor Web is easier than installing Kaspersky, while others are of the opposite opinion. However, if you approach with an open mind, opinions about the complexity of the installation look clearly far-fetched. An exception may be only server versions, when antivirus settings are required either on each network terminal or directly on the central server. These questions should be left system administrators, since an ordinary user does not need such knowledge at all.
But Doctor Web can easily be installed to put things in order in an already infected system, and problems with Kapersky are quite often observed in this regard.
Some differences in functionality
If we consider the standard security tools of Kaspersky or Doctor Web in terms of their functionality, a special difference can be seen only in details, since the standard sets of both developers are almost the same.
But what looks somewhat unusual for Kaspersky is the ability to connect any other device with a similar product to the installed antivirus and manage the protection system through Personal Area located on the My Kaspersky portal. This is a clear plus. As for cross-platform use, both antiviruses are in equal positions here (their versions can be found for almost all known operating systems installed both on stationary PCs and on mobile devices).
Response to viruses and suspicious threats
Now let's see which is better - Kaspersky or Doctor Web, when it comes to detecting threats and neutralizing them. Behind the scenes, it is commonly believed that Kaspersky's virus databases are the most complete. But this is debatable. But in terms of verification, some people think that Doctor Web clearly loses because it checks absolutely all files downloaded from the Internet, even if they do not pose a direct or perceived threat, which takes more time. In addition, the settings for scanning a computer in the background, which are used in both programs by default, also cause legitimate indignation of users when the scan starts at the most inopportune moment, which causes programs to freeze and system resources are fully used exclusively by antiviruses. . However, only those users who do not know how to set up a scheduled scan so that it occurs at those moments when the computer is idle can say this.
Load on system resources
As for the consumption of resources, many make an unequivocal conclusion about which is better - Kaspersky or Doctor Web.
For some reason, it is generally accepted that Kaspersky slows down the system incredibly, although the latest modifications (according to the developer's statements) are no different. Apparently, this is due to the well-established stereotype that has existed since the release of the first anti-virus products, when, with the standard anti-virus from Kaspersky Lab installed, even on powerful computers it was impossible to work.
Portable and Disk Utilities
Naturally, among the antiviruses of Kaspersky and Doctor Web there are also special curing programs that do not require installation on HDD computer or laptop (KVRT and Dr. Web CureIt! respectively). Both utilities are almost equal in their capabilities, however, often the dissatisfaction of users who scan their system with a portable application from Doctor Web is caused by the fact that it identifies many well-known optimizer programs or uninstallers as potentially unwanted software.
At the same time, it is believed that there is no possibility to disable treatment or removal for especially critical cases, and at the end of the scan, the installed applications refuse to work at all. In addition, Doctor Web does not respond to such activators as, for example, KMSAuto Net. On the one hand, this is good for the average user, on the other hand, this is the most illegal Windows activation. Kaspersky issues a warning about the detection of a legitimate activation program, but reports that it may contain malicious code. Disk utilities are at about the same level, although, again, it is tacitly believed that Kaspersky's Rescue Disk detects and neutralizes threats of any type better than Doctor Web's LiveDisk.
Which antivirus do you prefer?
So which is better - Kaspersky or Doctor Web? Alas, it is impossible to give a definite answer to this question. All of both developers deserve every praise, and the choice in favor of one thing often depends on user preferences or even a pre-formed stereotype. That is why you are given the right to make your own choice and install exactly the software product that you consider necessary and most effective.
Which antivirus is better, Kaspersky (Kaspersky) or Dr. Web (Doctor Web)!
In this I will not touch on other antiviruses. I just want to talk about these two.
I will tell my case. When I first went online, I didn't have an antivirus. Then I thought about this question. Found two online free antivirus Kaspersky and Dr. Web.
Installed, of course, Kaspersky (you guessed it right away). This is what 78.53% of users would do. Installation and activation went well. After when I came home from work (a certain number of days have passed), I found that the computer was working somehow wrong. I tried to start the antivirus, but it did not turn on. I have kaspersky antivirus on my flash drive. I inserted a flash drive and wanted to reinstall the antivirus program again. But the virus broke the antivirus again. I went online and wanted to download some other antivirus program. But as soon as I connected to the Internet, the virus immediately stole the Windows key from me. Windows began to appear on the screen with the inscription that you do not have a licensed Windows. All this ended with a reinstall of Windows. Now I installed Doctor Web.
Let's now figure out which antivirus is better. In fact, 100% protection does not exist. But each antivirus has its pros and cons. To be honest, Kaspersky has the best virus database, but its methods often lead to system freezes. And one more big minus all viruses are initially sharpened under Kaspersky. The main task of the virus is to destroy the antivirus program, and then quietly multiply. So by installing Kaspersky, there is a possibility that your antivirus will be broken. Also, when a virus enters a computer, it enters the antivirus database and removes itself from the database. And the antivirus then does not recognize it as a virus.
As for Doctor Web, he allows viruses to enter the computer, allows infection system files and only then it finds these infected files and cures them. But he has a very good program “Dr. Web CureIt. "Dr. Web CureIt” does not require installation and runs from any media. It has its own database of viruses. Just by running it from any medium, you check the entire computer.
For starters, you need to turn Windows into a fortress, you can configure the OS and send half of the malware to smoke!
Regular updating reduces the chance of computer infection.
Also do a full scan of your computer once a week or more, depending on how often you use your computer.
It is also necessary to properly configure the antivirus program, no matter which one you use.
Of course, no antivirus can provide 100% security, because. there is a “human factor” - the rules of behavior on the network must always be observed.