Check your Virus Scanner !

Don't believe what people are telling and don't trust what magazines are writing about the "best" virus scanner !!
Test it on your own !
With the content of the file "Infected Files.zip" (inside AntiVirusChecker.zip) you can check the quality of your virus scanner.

ATTENTION:
It is very important that you add additional action-based protection. A signature-based Virusscanner is unsecure!!
Read my detailed article about botnets and how to protect yourself!


Follow these steps and read the instructions to the end before you start !!

1. Create a new folder on your harddisk. (for example C:\Virus )
2. Unpack the content of the file "Infected Files.zip" into the new folder.
3. Configure your virus scanner to delete infected files.
   
   
   • If your virus scanner has enabled "AutoProtect" it should not allow to copy any of the infected files to disk.
     
   • If you have disabled "AutoProtect" tell your virus scanner afterwards to scan the new folder.
     
     
4. Now have a look into the new folder.
5. If there are any infected files unchanged in the folder, your computer is NOT fully protected !
   Only the file "bszip.dll" should remain.
   Note: Some files may have been repaired (e.g. Macroviruses removed from Word documents) so you should compare your folder with the origional files in the ZIP file! But the filesize may be the same! So you must binary compare the files or at least compare the file date. The best for this test is to tell your scanner not to repair but delete infected files.
6. Some virus scanners (e.g. F-Secure) come into trouble if you copy many infected files very rapidly to disk. If you copy the files one by one they detect them in AutoProtect mode but if you copy multiple files at once they detect only some of them !!
7. F-Secure is not able to delete an infection inside another file (e.g. attachment in email) and even if you tell it to delete the whole file (email) it tells you that this is not possible!
8. Additionally there are some other criteria to choose a virus scanner. E.g. Norton consumes much diskspace, makes your PC extremely slow and once installed you cannot turn it off anymore and the PC will not shutdown anymore!
9. Trendmicro Office Scan has a very bad habit: sometimes it scans the complete harddisk when the computer boots (before the logon screen appears). This may take up to 5 minutes in which you cannot use your computer!! You don't even get a message whats going on!
10. Some of the Scanners may also give false alarms!
11. Some scanners offer additional protection mechanisms. E.g. Kasperky's "Proactive protection" detects if a program tries to inject a DLL into other processes.

The password of the ZIP file is "this file contains malicious content".

Note: The names of worms / viruses which are displayed by the virus scanner may differ.
(Example: The Trojan.Anserin also has the names W32.Agent.SJG and Torpig-K, depending on the scanner)
The only important thing is THAT the infection is detected !

Notes:

1. Html.Bankfraud.E is not an infected file. But it is a malicious email, which asks you to enter your bank account data into a webpage which imitates the look of the origional page. (Phishing)
2. These test results were valid at the day the ZIP file was created. (May 2006)
   W32.Fontra was 5 days old at this time and not yet detected by all scanners.
3. To compare Virusscanners you can also upload an infected file to Virustotal which will scan it with 37 virus scanners!

Download ZIP file with infected archives on my download page.

	Zurück zur Startseite	(mit Inhaltsverzeichnis der Homepage)
	Back to start page	(with index of homepage content)