Trend Micro RootkitBuster 1.6.0.1055 Beta

[Wile E]

My performance test search is turning up fruitless. Everything I have found uses Kaspersky 5 in their testing, Ver 6 is much lighter on resources than 5. I'm starting to think I have it in hard copy around here, maybe Maximum PC or CPU mags.

I'm in the process of redoing my system. Should be done in a couple of hours. If you guys want, pick the benchmarks and the AV's and I'll run a few tests myself. Just keep in mind there has to be a way to fully clean the product from the system, and it needs to offer a fully functional trial, or equivalent.

 

[Scavar]

Thanks a lot everyone for the suggestions. Already trying out a lot of it.

Not too sure on all the ACL and NTFS/REG. I only ever knew a little bit. Going to do some reading on it though. I was never really worried for safety, but I don't want to have to worry about it either.

 

[Alec§taar]

alec read vb100% reviews, nod32 has gotten the most vb100% awards ever

Will do - I am ALWAYS on the "lookout" for that, ontop of the 'good word' of others...



* It's 'contagious stuff', word-of-mouth... you guys have me ALMOST wanting to give this NOD32 program from ESET a shot!

APK

 

[Alec§taar]

Well I'm still loooking for the performance tests, but in the meantime I found what seems to be a good site on AV effectiveness. http://www.av-comparatives.org/

Yup, been there before, but it HAS been awhile... I will take a peek again, shortly, after I reply to the last poster!



* EDIT PART - NOD32 seems to do VERY well, on the last test they did too no less, November 2006... this program's looking more appealing to me, by the minute!

APK

P.S.=> Above all else, don't sweat it - that page is current (enough so, imo) from NOV. 2006 results, to fit the bill here Wile E... thanks for the effort & the URL you did come up with! apk

 

[Alec§taar]

Thanks a lot everyone for the suggestions. Already trying out a lot of it.

You're welcome... it's always good to ask others, if you're not sure, & all that + to get their "feedback" on what tools are good etc. as well (because I don't know ANYONE that has tested every software out there under the sun!).

Not too sure on all the ACL and NTFS/REG. I only ever knew a little bit. Going to do some reading on it though. I was never really worried for safety, but I don't want to have to worry about it either.

The hardest part imo?

Learning what entities have the "most power" to the "least power" (by default, because you can alter this for ANYONE just about in secpol.msc & lusrmgr.msc) & how groups related to individuals IN SAID GROUPS work!

Also how they can 'inherit properties from their parent', cascading from root of disks (or registry hives) where you apply security on this end first, to subfolders & files (or, in the case of the registry, subhives & values) beneath them.

Once you get THAT part down, you can start applying them... knowing how to get out of a jam if you messup w/ them though? THE MOST IMPORTANT PART, of course!

LOL!

APK

P.S.=> In the "Securing Windows Services" sticky thread's last page as of today (02/15/2007) in the GENERAL SOFTWARE SECTION:

http://forums.techpowerup.com/showthread.php?p=258262#post258262

Right there in THAT response, I outlined this all for "CompletelyBonkers"!

(I.E.-> How to use ACL registry & NTFS rights, & how to GET OUT OF JAMS if you mess up using them as well, again, the MOST important part, because you CAN lock yourself out of your system with either one - NEVER remove SYSTEM or ADMINISTRATOR having FULL rights on either the registry, or the NTFS filesystem, & 9/10 times, you can STILL get back into your rig, & undo it, + try again)!

CompletelyBonkers' a relatively new user here, who turned me onto BELARC ADVISOR (decent security analysis program, but has SOME 'bugs' in it imo @ least) to analyze my security setup here, kind of 'forced me' to reapply what setups of mine in the past had, this stuff (ACL in registry being 'hardened', as well as NTFS filesystem rights too being 'hardened' more)...

When I ran it, initially, to get the highest score I could? WELL, I had to apply that stuff (new setup here, it wasn't done yet until that test, so it needed to be done again, so I redid it, had some interesting results too one time, didn't lock myself outta my rig, but I did manage to get Windows Server 2003 to run WITH NO SERVICES - very interesting!)

Anyhow... now it is done for both Registry ACL & NTFS rights, & more secure (ALL in order to get a better score on it on my part on the BELARC ADVISOR security test!)... apk

 

[Alec§taar]

ANOTHER ANTIVIRUS COMPARISON TEST, SPECIFICALLY ON MACRO-BASED TYPES IN OFFICE DOCUMENTS:

http://www.eweek.com/article2/0,1895,2095119,00.asp

Pertinent article exerpt:

==============================
"Andreas Marx of AV-Test, as reported in PC-Welt, tested AV protection against known (patched) and new (zero-day, unpatched) MS Office exploits (DOC, XLS, PPT and MDB). The article is in German, but it's pretty easy to read: The table shows the name of the product, the number detected, the detection percentage, the number missed and the percentage missed."
==============================

The results chart:

http://www.pcwelt.de/news/sicherheit/71459/index2.html



* May surprise some of you guys, how WELL that NAV did... another one of my former favs on 2000/XP in AntiVir DID beat it here though, but NAV is right on its tail, & ahead of NOD32, & many others.

See for yourselves...

APK

P.S.=> I am using NOD32 right now though, after disabling NAV Corporate 10.2's resident background tasks trayicon scanner & services, & DO like how it only runs 1 service... so far, it seems nice!

BUT, is it really BETTER (in the most important part - virus detection) than NAV, on ALL levels & types of virii out there? Not on this test...

However, I suppose it depends on the test I guess (like so many other things in life), but the one above's about the MOST PREVALENT TYPE OF INFECTOR THERE IS imo, documents based macro types, @ least lately (they seem to be more of the trend, vs. binary types like bootsector, binary/executable infectors, etc. which makes sense - their code is EASY to get @ & alter to another nearly completely diff. kind)... apk

 

[Testing]

I'm in the hunt for memory usage numbers.

Seems everytime I get together with different security suite or firewall+anti virus combo users, I end up losing the information.

(boot/startup load MB)
Norton : ?
McAfee : ?
Sopho : ?
ZA Suite : ?
Panda: ?

(make up your own combo)
ZA Pro + fprot
BlackIce + AVG


Help me restore my list!

 

[AshenSugar]

as stated in pm, bice+fprot for ram use, nod32 is 2nd runner up for av in this case.

and macroviruses seems to happend in "jumps" u see them then NONE for a VERY VERY VERY long time, then somebody brings one to work.

i have also found that some av's like norton will see non virilant macro's as infected and wil want to remove them, this can be annoing when you put the macro there for a reasion and need to use it for a presentation

every review shows diffrent results, one thing i find funny is when u see reviews of viri apps that some of the apps get advanced setting changed and others dont, f-prot works FAR FAR better if you enable huristics and nural network with them enabled on older versions i found no greater system load but FAR better unknown detection.

 

[Alec§taar]

I'm in the hunt for memory usage numbers.

Seems everytime I get together with different security suite or firewall+anti virus combo users, I end up losing the information.

(boot/startup load MB)
Norton : ?
McAfee : ?
Sopho : ?
ZA Suite : ?
Panda: ?

(make up your own combo)
ZA Pro + fprot
BlackIce + AVG


Help me restore my list!

Well, 2 I am going to compare (on this note, Memory use & CPU cycles used, most likely) are going to be NOD32 & NAV Corporate Edition 10.2, using a tool like SysInternals ProcessExplorer (because it can 'break out' the constituent processes in services being brokered/run by svchost.exe, services.exe, etc. et al & much like taskmgr.exe can, w/ DOS & Win16 processes under ntvdm.exe).




* Hey - I am curious myself! I think lemonadsoda & I, or AshenSugar & I, have debated that point as well sometime in the past here, but I never got around to testing it (I didn't load NOD32 before is why, now I have & CAN test this, on which consumes more "resources", specifically memory & CPU cycles).

Is there a "definitive test" out there for DETECTION superiority? Doubt it!

See, I have yet to see one to date, but the 1 url I put up above shows NAV beating NOD32 in macro-virus detections, & I know 1 thing FOR SURE - it is easier to build macro-virus, because it is simpler to get @ their code than it is say, for binary/executable file infectors.

(That said, it is no small wonder you see more of those today as infectors/virus vectors: You can get their code relatively fast & alter it into a completely NEW virus infection type (Ms has done a good job in Office 2003-2007, afaik, in that AutoExec Macros running by default is protected against better than it used to be in Office versions 2000 & below))

Anyways/anyhow - I'll do that sometime soon, mainly because I'm curious in this regard as well (how much memory & cpu cycles NOD32 eats, vs. Norton Corporate 10.2).

APK

 

[AshenSugar]

we did , you never posted shots of nav resorce use dispite your demanding i post shorts of nod32 resorce use >.<

 

[Wile E]

Here's the comparison of ram usage with Kaspersky Internet Security.

Kaspersky off = 158MB ram

Kaspersky on = 196MB ram

These figures were taken 2 min after a fresh boot both times, with nothing run in between. Kaspersky was set to not load at start up for the off test.

I've also taken a screenshot of the running protection features. Internet Security offers a couple of extra protection features, including a firewall(Anti-Hacker in the pic). I didn't install the features it offers for mail protection and anti-spam, as I don't use any mail progs on my pc, I use the Mac for that. iirc, The anti-virus only package only includes the first 3 protections.

I'm gonna re-install it with only the Anti-virus options enabled(it's an option during setup), to see what that ram usage is like. I also plan on running pcmark in both setups vs. off. I'll make a new post with my results.

 

[Testing]

Thanks Wile!

I noticed that ZA security suite 6.5 with moderate page faulting results in this at startup:

Zlclient -5mb
Vsmon -28mb
CA-Isafe -off

However, the PFile is reduced by over 40mb when ZA is not loaded on boot. Page faults causing the MB difference?


Argh

 

[Alec§taar]

we did , you never posted shots of nav resorce use dispite your demanding i post shorts of nod32 resorce use >.<

Yea, I screwed up... I get 'side tracked' @ times, & sometimes never get back to folks, but I DO TRY!

However, the good side, NOW, is? I can do both now, NOD32 &/or NAV Corp. 10.2 edition!

I will get on it @ SOME POINT, this week (I will man, you've turned up a "good egg" here imo, albeit a TOUGH 'hard-boiled egg' on some accounts (can you say "V I S T A"? I knew you could!))

Yup, @ times? You're one that actually 'spooks me' in fact @ times on stuff in this field, as far as doubting or confronting you on some points (specifically software saavy, & I WILL definitely give you that!)

* Anyhow - we'll get on it soon this week, because I too, am curious, & WOULD like to make some determinations on this account too!

APK

 

[AshenSugar]

apk its call having no life, i honestly know more then i probbly should about random apps and tweaks that help.

and that tweaks thred, i couldnt respond thanks to that wanker, i wanted to point out that if you have 3+gb ram using system cache mode can be good, i use it and guess what, everythings smoother

it really depends on the system use, prefetching can be good or bad, boot prefecth is good for me but app prefetch acctualy dosnt benifit me at all because i dont use a small limmited number of the same apps every boot, i use ALOT of apps everyday

and vista is crap, maby after sp1 it wont be, but thats a big maby, server 2008 may not suck, it may acctualy have some nice fetures, like 2003 vs xp, but then again ,why buy vista for WAY TO MUCH, when veinna is due out in 2 years?

 

[Wile E]

Ok, I decided to redo my Kaspersky installation to the full suite for the purpose of testing. Here's my results:

KIS off = 158MB ram(as per my previous post)

KIS on = 196MB ram (full suite installed, no modules left uninstalled)

PCMark05 scores:

KIS off = 5874

KIS on = 5817

It seems Kaspersky had the biggest effect on web rendering. In my personal experience, there is very little lag on my system using it. Way better than the Norton 05 Suite that I came from. (Is there any surprise there? lol) Next set of tests is Kaspersky with only the anti virus features installed. (The Internet Security Suite installer offers the option to install just the options offered by their standard anti virus) I think I might install NOD32 after that, just cause I'm curious as to how they compare in terms of performance.

 

[Wile E]

Well, it seems my idea of using PCMark05 to test performance wasn't a good one. I can't seem to get repeatable results. My web page rendering scores consistently go down, even if Kaspersky isn't installed. I even tried clearing IE7's browsing history, cookies, forms, etc., etc. Although the PCMark testing failed, I'm open to suggestions to other testing ideas to examine av resource usage and performance effects. In the meantime, I did look at ram usage on boot up with Kaspersky Anti Virus installed and running. Kaspersky AV=193MB on boot. No AV=158MB.