Can't you just come out with it and tell us all just what these relative
weaknesses in NOD32 are? As a user I would like to know.
Can't you see many of them for yourself in the comparative Ceily
posted in this thread? Not that that test is the best by any means but
the results aren't dissimilar to results I've seen in the past done by
av-test.org (and results I get myself). It's also known to exhibit a
unusually high false positive rate. It too often gives a lame
heuristic report rather than a exact identification like KAV does.
Not good for cleanup and disinfection when it can't ID a specific
malware and variant. In my old DOS virus collection it still misses
most virus droppers on-demand while scanners like KAV, F-Prot and
McAfee have no problem with them. And there's no av that handles
"containers" the way KAV can. For example, various oddball runtime
packers designed to defeat scanners, sometimes multiply packed with
different packers. And KAV scans "within" many archives including many
SFX better than any scanner I've ever tested.
And are you also implying that Kaspersky has no relative weaknesses?
Well since you put in terms of relativity (to other scanners) I'm hard
pressed to think of any off hand other than the fact that its realtime
monitor has been reported to bog down some systems. Of course, when
you get away from the technical aspects to the subjective, I can't
guess anyone's preferences. Some people are fascinated with scanning
email while to me it's absolutely useless.
I might add that some definitions of "zoo" malware are misleading. I
think Symantec says that zoo viruses are found in the laboratory, or
something like that, giving the impression that they aren't in
circulation. But there have been cases where malware that never made
it to the official ITW list were out there causing heavy damage. And I
find malware being dumped on newsgroups all the time which aren't on
the ITW list. Plus, anyone can download thousands of zoo malwares from
various internet sites. And I've helped users nailed by malware not on
the ITW lists. So IMO too much is made of ITW tests. And the use of
pass/fail criteria is infantile and very misleading.
(Time now for flames from the NOD32 worshipppers. Aren't religious
wars wonderful?
)
Art
http://www.epix.net/~artnpeg