Workstationsav百科

WholeProductDynamicTest–2010www.
av-comparatives.
org-1-WholeProductDynamicTestAugust-November2010Language:EnglishDecember2010Lastrevision:10thDecember2010www.
av-comparatives.
orgWholeProductDynamicTest–2010www.
av-comparatives.
org-2-ContentIntroduction3TestProcedure.
4PreparationforTestSeries4Lab-Setup.
4HardwareandSoftware.
4Settings.
5PreparationforEveryTestingDay.
5TestingCycleforeachmaliciousURL5Sourceoftestcases6TestSet.
6Comments.
6Testedproducts7TestCases.
7DiagrammaticOverview.
8Results9SummaryResults.
10Whole-ProductFalseAlarmTest.
11FalseAlarmsondomains(whilebrowsing)11FalseAlarmsonfiles(whiledownloading/installing)12Certificationlevelsreachedinthistest13CopyrightandDisclaimer.
14WholeProductDynamicTest–2010www.
av-comparatives.
org-3-IntroductionThethreatposedbymalicioussoftwareisgrowingdaybyday.
Notonlyisthenumberofmalwarepro-gramsincreasing,alsotheverynatureofthethreatsischangingrapidly.
Thewayinwhichharmfulcodegetsontocomputersischangingfromsimplefile-basedmethodstodistributionviatheInternet.
Mal-wareisincreasinglyinfectingPCsthroughe.
g.
usersdeceivedinvisitinginfectedwebpages,installingrogue/malicioussoftwareoropenemailswithmaliciousattachments.
Thescopeofprotectionofferedbyantivirusprogramsisextendedbytheinclusionofe.
g.
URL-blockers,contentfiltering,anti-phishingmeasuresanduser-friendlybehavior-blockers.
Ifthesefeaturesareper-fectlycoordinatedwiththesignature-basedandheuristicdetection,theprotectionprovidedagainstthreatsincreases.
Inspiteofthesenewtechnologies,itremainsveryimportantthatthesignature-basedandheuristicdetectionabilitiesofantivirusprogramscontinuetobetested.
Itispreciselybecauseofthenewthreatsthatsignature/heuristicdetectionmethodsarebecomingevermoreimportanttoo.
Thegrowingfre-quencyofzero-dayattacksmeansthatthereisanincreasingriskofmalwareinfection.
Ifthisisnotin-terceptedby"conventional"or"non-conventional"methods,thecomputerwillbeinfected,anditisonlybyusinganon-demandscanwithsignatureandheuristic-baseddetectionthatthemalwarecanbefound,andhopefullyremoved.
Theadditionalprotectiontechnologiesalsooffernomeansofcheckingexistingdatastoresforalready-infectedfiles,whichcanbefoundonthefileserversofmanycompanies.
Thosenewsecuritylayersshouldbeunderstoodasanadditiontogooddetectionrates,notasreplace-ment.
Inthistestallfeaturesoftheproductcontributeprotection,notonlyonepart(likesignatures/heuristicfilescanning).
Sotheabilityofprotectionshouldbehigherthanintestingonlypartsoftheproduct.
Wewouldrecommendthatallpartsofaproductwouldbehighindetection,notonlysinglecomponents(e.
g.
URLblockingprotectsonlywhilebrowsingtheweb,butnotagainstmalwareintroducedbyothermeansoralreadypresentonthesystem).
TheWhole-Product-DynamictestisaprojectofAV-ComparativesandtheUniversityofInnsbruck,facultyofComputerScienceandQualityEngineering.
ItispartiallysupportedbytheAustrianGovernment.
Somedetailsaboutthetestprocesscannotbedisclosed,asitcouldbeeasilymisusedbyvendorstogamethetestsystems.
WholeProductDynamicTest–2010www.
av-comparatives.
org-4-TestProcedureTestinghundredsofURL'sadaywithdozensofantivirusprogramsmakesatotalofthousandsURLtestsandonlyahighdegreeofautomationmakesthispossible.
ThisautomationhasbeendevelopedjointlywiththeInstituteofComputerScienceoftheUniversityofInnsbruckandAV-Comparatives.
Overtheyearwehadtointroduceseveralchangesintheautomatedsystemstocircumventandalsopre-ventsomeAVvendorstryingto"game"thesystem,aswellasupdate/rewriteourtoolsdueunannouncedchangesinthesecurityproductswhichmadeithardertocreateautomatedsystems.
Duethat,thestartofourwhole-product-dynamicteststartedwithsomedelay.
Wekindlyaskvendorstoinformusinad-vanceincaseofproductchangeswhichcanaffectautomatedtestingsystems.
PreparationforTestSeriesEveryantivirusprogramtobetestedisinstalledonitsowntestcomputer(pleasenotethattheterm"antivirusprogram"asusedheremayalsomeanafullInternetSecuritySuite).
Allcomputersarecon-nectedtotheInternet,eachwithitsownexternalIPaddress.
Thesystemisfrozen,withtheoperatingsystemandantivirusprograminstalled.
Lab-SetupTheentiretestisperformedonrealworkstations.
Wedonotuseanykindofvirtualization.
Eachwork-stationhasitsowninternetconnectionwithitsownexternalIP.
Wehavespecialagreementswithsev-eralproviders(failoverclusteringandnotblockinganytraffic)toensureastableinternetconnection.
Thetestsareperformedusingaliveinternetconnection.
Wetookthenecessaryprecautions(withspecialconfiguredfirewalls,etc.
)nottoharmothers(i.
e.
nottocauseoutbreaks).
HardwareandSoftwareForthistestweusedidenticalworkstations,anIBMBladecenterandnetworkattachedstorage(NAS).
VendorTypeCPURAMHardDiskWorkstationsFujitsuE3521E85+IntelCore2Duo4GB80GBBladeCenterIBMEChassis---BladesIBMLS20AMDDualOpteron8GB76GBNASQNAPTS-859U-RPAtomDualCore1GB16TBRaid6ThetestsareperformedunderWindowsXPSP3withnofurtherupdates.
Furtherinstalled(vulnerable)softwareincludes:VendorProductVersionVendorProductVersionAdobeFlashPlayerActiveX10.
1MicrosoftInternetExplorer7AdobeFlashPlayerPlug-In10MicrosoftOfficeProfessional2003AdobeAcrobatReader8.
0Microsoft.
NETFramework3.
5SunJava6.
0.
140WholeProductDynamicTest–2010www.
av-comparatives.
org-5-SettingsWeuseeverysecuritysuitewithitsdefault(out-of-the-box)settings.
Ifuserinteractionsarerequired,wewillchoosethedefaultoption.
Ourwhole-productdynamictestaimstosimulatereal-worldconditionsasexperiencedeverydaybyusers.
Therefore,ifthereisnopredefinedaction,wewillalwaysusethesameactionwhereweconsiderthewarning/messagetobeveryclearanddefinitive.
Ifthemessageleavesituptotheuser,wewillmarkitassuchandifthemessageisveryvague,misleadingorevensuggestingtrustinge.
g.
themaliciousfile/URL/behavior,wewillconsideritasamiss,astheordinaryuserwould.
Weconsideraprotectionifthesystemisnotcompromised.
Thismeansthatthemalwareisnotrunning(orisremoved/terminated)andtherearenosignificant/malicioussystemchanges.
Anout-bound-firewallalertaboutarunningmalwareprocess,whichaskswhethertoblocktrafficformtheusers'workstationtotheinternetistoolittle,toolateandnotconsideredasprotectionbyus.
PreparationforeveryTestingDayEverymorning,anyavailableantivirussoftwareupdatesaredownloadedandinstalled,andanewbaseimageismadeforthatday.
Thisensuresthateveninthecasetheantiviruswouldnotfinishabiggerupdateduringtheday,itwouldatleastusetheupdatesofthemorning,likeitwouldhappentotheuserinthereal-world.
TestingCycleforeachmaliciousURLFirstofall,thereisresearching.
Withourowncrawlerwearesearchingthewebconstantlyformalicioussites.
Wearenotfocusingonzero-daymalware/exploits(althoughitispossiblethattheyarealsopre-sentintheURLpool);wearelookingformaliciouswebsitesthatarecurrentlyoutthereandbeingathreattotheordinaryusers.
BeforebrowsingtoeachnewmaliciousURL/test-caseweupdatethepro-grams/signatures.
Newmajorproductversionsareinstalledonceamonth,that'swhyineachmonthlyreportweonlygivetheproductmainversionnumber.
Ourtest-softwarestartsmonitoringthePC,sothatanychangesmadebythemalwarewillberecorded.
Furthermore,thedetectionalgorithmscheckwhethertheantivirusprogramdetectsthemalware.
Aftereachtestcasethemachineisrevertedtoitscleanstate.
ProtectionSecurityproductsshouldprotecttheuser'sPC.
Itisnotveryimportantatwhichstagetheprotectiontakesplace.
Thiscaneitherbewhilebrowsingtothewebsite(e.
g.
protectionthroughURLBlocker),whileanexploittriestorunorwhilethefileisbeingdownloaded/createdorwhilethemalwareisexe-cuted(eitherbytheexploitorbytheuser).
Afterthemalwareisexecuted(ifnotblockedbefore),wewaitseveralminutesformaliciousactionsandalsotogivee.
g.
behavior-blockerstimetoreactandrem-edyactionsperformedbythemalware.
Ifthemalwareisnotdetectedandthesystemisindeedin-fected/compromised,theprocessgoesto"MalwareNotDetected".
Ifauserinteractionisrequiredanditisuptotheusertodecideifsomethingismalicious,andinthecaseoftheworstuserdecisionthesys-temgetscompromised,weratethisas"user-dependent".
Duethat,theyellowbarsintheresultsgraphcanbeinterpretedeitherasprotectedornotprotected(it'suptotheuser).
WholeProductDynamicTest–2010www.
av-comparatives.
org-6-Duethedynamicnatureofthetesttomimicreal-worldconditionsandduethewayseveraldifferenttechnologieswork(likecloudscanners,reputationservices,etc.
),itisamatteroffactthatsuchtestscannotberepeatedorreplicatedlikee.
g.
staticdetectionratetests.
Anyway,wearetryingtologasmuchasreasonablypossibletoproveourfindingsandresults.
Vendorsareinvitedtoprovideusefullogsinsidetheirproductswhichcanprovidethemwiththeadditionalproof/datatheywant.
Vendorsweregivenonetotwoweekstimeaftereachtestingmonthtodisputeourconclusionaboutthecompromisedcases,sothatwecouldrecheckifthereweremaybesomeproblemsintheautomationorwithouranaly-sisoftheresults.
Inthecaseofcloudproducts,wewillonlyconsidertheresultsthattheproductshadatthetimeoftest-ing;sometimesthecloudservicesprovidedbythesecurityvendorsaredownduetofaultsormainte-nancebythevendors,butthisisoftennotdisclosed/communicatedtotheusersbythevendors.
Thisisalsoareasonwhyproductsrelyingtoomuchoncloudservicescanberisky,asinsuchcasesthesecurityprovidedbytheproductscandecreasesignificantly.
Cloudsignatures/detection/reputationshouldbeimplementedintheproductstoincreasetheotherprotectionfeatures(likelocalreal-timescandetectionandheuristics,behavior-blockers,etc.
)andnotreplacethemcompletely,ase.
g.
offlinecloudservicesmeanthePC'smaybeexposedtohigherrisks.
SourceoftestcasesWeuseourowncrawlingsystemtosearchcontinuouslyformalicioussitesandextractmaliciousURLs(includingspammedmaliciouslinks).
WealsoresearchmanuallyformaliciousURLs.
Ifourin-housecrawlerdoesnotfindenoughvalidmaliciousURLsononeday,wehavecontractedsomeexternalre-searcherstoprovideadditionalmaliciousURLsexclusivelytoAV-Comparatives.
AlthoughwehaveaccesstoURLssharedbetweenvendorsandotherpublicsources,werefrainfromusingtheseforthetests.
TestSetWearenotfocusingonzerodayexploits/malware,butoncurrentandrelevantmalwarethatiscurrentlyoutthereandproblematictousers.
Wearetryingtoincludeabout30-50%URLspointingdirectlytomalware.
Forexample,iftheuseristrickedbysocial-engineeringtofollowlinksinspammailsorweb-sitesoriftheuseristrickedintoinstallingsomeTrojanorotherroguesoftware.
Therest/biggerpartwereexploits/drivebydownloads.
Thoseseemtobeusuallywellcoveredbysecurityproducts.
Inthiskindoftesting,itisveryimportanttouseenoughtestcases.
Ifaninsufficientnumberofsam-plesareusedincomparativetests,differencesinresultsmaynotindicateactualdifferencesamongthetestedproducts1.
CommentsMostoperatingsystemsalreadyincludeownfirewalls,automaticupdatesandmayevenprompttheuserbeforedownloadingorexecutingfilesiftheyreallywanttodothat,warningthatdownloading/executingfilescanbedangerous.
Mailclientsandwebmailsincludespamfilterstoo.
Furthermore,mostbrowsersincludePop-Upblockers,Phishing/URL-Filtersandthepossibilitytoremovecookies.
1Readmoreinthefollowingpaper:http://www.
av-comparatives.
org/images/stories/test/statistics/somestats.
pdfWholeProductDynamicTest–2010www.
av-comparatives.
org-7-Thosearejustsomeofthebuild-inprotections,butdespiteallofthem,systemscangetinfectedany-way.
Thereasonforthisisinmostcasesistheordinaryuser,whomaygettrickedbysocialengineeringintovisitingmaliciouswebsitesorinstallingmalicioussoftware.
Usersexpectasecurityproductnottoaskthemiftheyreallywanttoexecuteafileetc.
butexpectthatthesecurityproductwillprotectthesysteminanycasewithoutthemhavingtothinkaboutit,andde-spitewhattheydo(i.
e.
executingunknownfiles/malware).
Wetrytokeepinmindtheinterestsoftheusersanddelivergoodandeasy-to-readtestreports.
Wearecontinuouslyworkingonimprovingfurtherourautomatedsystemstodeliverabetteroverviewaboutproductcapabilities.
TestedproductsThefollowingproductstakepartintheofficialWhole-Product-Dynamicmaintest-series2.
Wemaytestalsootherproductswhicharenotpartofthemaintest-series,butonlyseparatelyandforalimitedtime-period.
InthistypeoftestweusuallyincludedInternetSecuritySuites,althoughalsootherproductversionswouldfit,becausewhatistestedisthe"protection"providedbythevariousproductsagainstasetofreal-worldthreats.
Mainproductversionsusedforthemonthlytest-runs:VendorProductVersionAugustVersionSeptemberVersionOctoberVersionNovemberAvastInternetSecurity5.
05.
05.
05.
0AVGInternetSecurity9.
09.
010.
010.
0AviraPremiumSecuritySuite10101010BitDefenderInternetSecurity2010201120112011ESETSmartSecurity4.
24.
24.
24.
2F-SecureInternetSecurity2010201120112011GDataInternetSecurity2011201120112011KasperskyInternetSecurity2011201120112011KingsoftInternetSecurityPlus2010201020112011NormanSecuritySuitePro8.
08.
08.
08.
0PandaInternetSecurity2011201120112011PCToolsInternetSecurity2010201120112011SymantecNortonInternetSecurity2011201120112011TrendMicroTitaniumInternetSecurity20103201120112011TestCasesTestperiodTest-cases10thto26thAugust20103047thto25thSeptember20107027thto21stOctober20104548thto23rdNovember2010508TOTAL19682McAfeewasnotincludedduetomiscommunicationregardingtheirparticipation.
3TrendMicroInternetSecurity2010.
WholeProductDynamicTest–2010www.
av-comparatives.
org-8-DiagrammaticOverview44AsofAugust2010.
Furtherenhancements,changesoradditionsmayhavebeenimplementedsincethen.
WholeProductDynamicTest–2010www.
av-comparatives.
org-9-ResultsBelowyouseeanoverviewofthepastsingletestingmonths.
Percentagescanbeseenontheinteractivegraphonourwebsite5.
August2010–304testcasesSeptember2010–702testcasesOctober2010–454testcasesNovember2010–508testcasesWedonotgiveinthisreportexactnumbersforthesinglemonthsonpurpose,toavoidthatlittlediffer-encesof1-2casesaremisusedtostatethatoneproductisbetterthantheotheronagivenmonthandtest-setsize.
Wegivethetotalnumbersinthesummary,wherethesizeofthetest-setisbiggerandmoresignificantdifferencesmaybeobserved.
5http://www.
av-comparatives.
org/comparativesreviews/dynamic-testsWholeProductDynamicTest–2010www.
av-comparatives.
org-10-SummaryResults(August-November)6Testperiod:August–November2010(1968Testcases)BlockedUserdependentCompromisedPROTECTIONRATE[Blocked%+(Userdependent%)/2]7Cluster8F-Secure1946-2298,9%1Symantec1936191398,9%1AVIRA1943-2598,7%1Kaspersky1925192498,3%1GDATA192224497,7%2AVG191015797,1%2Panda1903-6596,7%2Avast1898-7096,4%2ESET188787396,1%2TrendMicro1888-8095,9%2PCTools1886-8295,8%2BitDefender1874-9495,2%2Norman1771-19790,0%3Kingsoft1620-34882,3%4Thegraphbelowshowstheaboveprotectionrateoverallsamples,includingtheminimumandmaximumprotectionratesforthesinglemonths.
6Fordetailedresultsofeachmonth,pleasehavealookatthegraphicaloverviewonourwebsite.
7Userdependentcasesweregivenahalfcredit.
Example:ifaprogramgets80%blocked-ratebyitself,plusanother20%user-dependent,wegivecreditforhalftheuser-dependentone,soitgets90%altogether.
8HierarchicalClusteringMethod:definingfourclustersusingaveragelinkagebetweengroups(Euclidiandistance)ontheprotectionrate.
WholeProductDynamicTest–2010www.
av-comparatives.
org-11-Whole-ProductFalseAlarmTestThefalsealarmtestintheWhole-Product-Dynamictestconsistsoftwoparts:a)FalseAlarmsondomains(whilebrowsing)b)FalseAlarmsonfiles(whiledownloading/installing)Itisnecessarytotestbothscenariosbecausetestingonlyoneofthetwoabovecasescouldpenalizeproductswhichfocusmainlyononetypeofprotectionmethod,eithere.
g.
URL/reputation-filteringore.
g.
on-access/behavior/reputation-basedfileprotection.
a)FalseAlarmsondomains(whilebrowsing)ForthisFalseAlarmtestweuseddomainslistedintheGoogleTop10009siteslistofAugust2010.
WetestedagainstthoseTop-Level-Domainstwice,inSeptemberandinOctober.
Non-maliciousdomainswhichwereblockedatanytime(eitherSeptemberorOctober)werecountedasFPs(astheyshouldneverhavebeenblocked).
Allbelowwebsitesareamongthemostpopularwebsitesontheweb(rankedonAlexa10betweenplace~300and~3000worldwide)11.
Thedomainsbelowhavebeenreportedtotherespectivevendorsforreviewandarenownolongerblocked.
Wedonotdisplaythedomainsaswedonotknowifinfuturetheymaybestillclean(andwealsowanttoavoidmakingpublicityforthosedomains).
Byblockingthewholedomainslikeinthecasesbelow,thesecurityproductsarecausingpotentialfinan-cialdamage(besidethedamageonwebsitereputation)tothedomainowners,includinglossofe.
g.
adsrevenue.
Duethat,westronglyrecommendvendorstoblockwholedomainsonlyinthecasewherethedomain'ssolepurposeistocarry/delivermaliciouscode,andtootherwiseblockjustthemaliciouspages(aslongastheyareindeedmalicious).
Fromthetestedvendors,thefollowingvendorshadFPsonthetesteddomainsduringthetestingperiod:F-Secure1FPhttp://www.
w#b#ra#l#r.
comGDATA1FPhttp://www.
b#n#e#s#.
comPanda1FPhttp://www.
i#o#n#o#d#n#i#i#e#.
comPCTOOLS4FPshttp://www.
5#.
comhttp://www.
2#4#.
comhttp://www.
d#o#e.
comhttp://www.
p#a#s#s#i.
comSymantec1FPhttp://www.
w#z#t#.
plTrendMicro4FPshttp://www.
b#n#e#s#.
comhttp://www.
i#o#n#o#d#n#i#i#e#.
comhttp://www.
n#w#o#n#o#d#l#.
comhttp://www.
p#a#s#s#i.
com9http://www.
google.
com/adplanner/static/top100010http://www.
alexa.
com11Currently(December2010,http://www.
domaintools.
com/internet-statistics)about125milliondomainsareac-tiveandabout100000newTop-Level-Domainsappeareachday,whichisfarmorethannewuniquemalwareappeareachday.
WholeProductDynamicTest–2010www.
av-comparatives.
org-12-Somefewmorewebsiteswereblockedbyvariousproducts,butnotcountedasFPsherethistime.
Thosecasesweremainlywebsitesordownloadportalscurrentlystillhosting/promotingalsosomeadwareorunlicensedsoftwareetc.
Manyproductscontinuetoblockwebsitesevenwhentheyarenolongermali-ciousandhavealreadybeencleanedupforsometime.
Thishappensalsowithpopularwebsites,butofcourseevenmorewithlesspopular/prevalentwebsites,withtheriskofturningthesecurityproductsintoawebcensoringtoolwhichgoestoofarinblockingwebsites(basedonwhatthesecurityvendorconsidersbeingariskorpotentiallyunwantedcontentfortheuser).
Itwouldbemuchbetteriftheproductwereonlytoblocktheaccesstothemaliciouspart/fileinsteadofawholewebsite/domainwhichisnotmaliciousbyitself(e.
g.
notcontaininganydrive-by/exploitsetc.
),unlesstheuserwantsanden-ablese.
g.
aparentalcontrolsettingorsimilar.
ProductswhichtendtoblockURLsbasede.
g.
onreputa-tionmaybemorepronetothisandscorealsohigherinprotectiontests,astheyblockmanyunpopularandstrangelookingwebsites.
AfurtheroptionforfutureFPtestingcouldbetousesuchURLswhicharediscardedascleanordownduringmalwaretesting.
AtthemomenttheAVindustryisdiscussingaboutwhat/whenandunderwhichcircumstancesablockedwebsitewhichisnotornolongermaliciousbyitselfcanbeconsideredasa"falsealarm",asopinionsarevaryingevenamongvendors.
Wewilllookattheoutcomeofthatdiscussionandconsideritifthismakessensealsofromauserperspective.
b)FalseAlarmsonfiles(whiledownloading/installing)ForthisFalseAlarmtestweusedsoftwarelistedasTop100Freewaredownloadsin2010ofapopularGermandownloadportal12.
Wemaychangetheuseddownloadportalsandcleansitesourceseverytime(andmaybealsonolongerdisclosewhichportals/listswereused),inordertoavoidthatvendorsfocusonwhitelisting/trainingmainlyagainstthosesites/lists/sources.
Wetestedonlywith100applications,asthistestwasdonemanuallyinordertoinstalltheprogramscompletelyandalsousethemafterwardstoseeiftheygetblocked.
WemayautomatealsothistypeofFPtestinginordertogetbiggertest-setsinfuture.
Noneoftheproductshadafalsealarmonthoseverypopularapplications.
Thereweresomefirewallalerts,butaswedonotconsiderfirewallalerts(forprogramstryingtoaccesstheinternet)asprotectioninthedynamictests,wearealsonotconsideringthemasFPs.
ItwouldbesurprisingtoencounterFPsonverypopularsoftwareinthecaseofwell-knownandinternationallyusedAV's,especiallyasthetestisdoneatonepointintimeandFPsonverypopularsoftwarearenoticedandfixedwithinfewhours.
Probablyitwouldmakemoresensetotestagainstlower-prevalencesoftware.
WeobservedaccidentallyalsosomeFPsonlesspopularsoftware/websites,buthavenotincludedthemthistimeasvendorsdonotseethemasabigissue.
Ifyouthinkdifferent,pleaseletthem(notus,asweknowalready!
)knowwhatyouasauserthinkaboutFPsthathappentoyouonlesspopularfilesandwebsites.
AswedonotyethavemuchexperienceaboutFPratesinWhole-Product-Dynamictesting,wearenotconsideringtheFPsintheawardsthistime,butwemaygivelowerawardstoproductswhichwillhaveFPs(ormanyuserinteractions)infutureWhole-Product-DynamicTests.
12http://www.
pcwelt.
deWholeProductDynamicTest–2010www.
av-comparatives.
org-13-CertificationlevelsreachedinthistestWeprovidea3-level-ranking-system(STANDARD,ADVANCEDandADVANCED+).
Overviewsoflevelsreachedinpreviousmaintestscanbefoundonourwebsite13.
Theawardsaredecidedandgivenbythetestersbasedontheobservedtestresults(afterconsultingstatisticalmodels).
ThefollowingcertificationlevelsarefortheresultsreachedintheWhole-Product-DynamicTest:CERTIFICATIONLEVELSPRODUCTSF-SecureSymantecAVIRAKasperskyGDATAAVGPandaAvastESETPCToolsTrendMicroBitDefenderNormanKingsoft13http://www.
av-comparatives.
org/comparativesreviews/main-tests/summary-reportsWholeProductDynamicTest–2010www.
av-comparatives.
org-14-CopyrightandDisclaimerThispublicationisCopyright2010byAV-Comparativese.
V.
.
Anyuseoftheresults,etc.
inwholeorinpart,isONLYpermittedaftertheexplicitwrittenagreementofthemanagementboardofAV-Comparativese.
V.
,priortoanypublication.
AV-Comparativese.
V.
anditstesterscannotbeheldliableforanydamageorlosswhichmightoccurasresultof,orinconnectionwith,theuseoftheinformationprovidedinthispaper.
Wetakeeverypossiblecaretoensurethecorrectnessofthebasicdata,butaliabilityforthecorrectnessofthetestresultscannotbetakenbyanyrepresentativeofAV-Comparativese.
V.
Wedonotgiveanyguaranteeofthecorrectness,completeness,orsuitabilityforaspecificpurposeofanyoftheinformation/contentprovidedatanygiventime.
Nooneelseinvolvedincreating,produc-ingordeliveringtestresultsshallbeliableforanyindirect,specialorconsequentialdamage,orlossofprofits,arisingoutof,orrelatedto,theuseorinabilitytouse,theservicesprovidedbythewebsite,testdocumentsoranyrelateddata.
AV-Comparativese.
V.
isaregisteredAustrianNon-Profit-Organization.
FormoreinformationaboutAV-Comparativesandthetestingmethodologiespleasevisitourwebsite.
AV-Comparativese.
V.
(December2010)WholeProductDynamicTest–2010www.
av-comparatives.
org-15-Advertisement