Compared Proactive Detection

• www.av-comparatives.org is an Austrian research lab that performs retrospective tests.
• www.virustotal.com produces a newsletter listing vendors that detect outbreaks as they occur.

AV-Comparatives
The independent testing institution AV-Comparatives.org is an antivirus research project coordinated by Andreas Clementi with the support of the Innsbrucker Kompetenzzentrum / Computernotdienst. The AV-Comparatives.org “Retrospective/Proactive Test” compared 11 different antivirus products’ abilities to proactively identify the increasing complexity and zero-day nature of today’s threats. The stringent testing used recent In-the-Wild samples and a variety of other malware, Trojans, viruses and worms affecting Windows and other operating systems. To effectively test the products for proactive detection, the organization used new malware samples, and tested them against the products without updating the antivirus signature.

The November study revealed that of the eight new viruses that have been released In-the-Wild in the preceding three months, customers of Symantec, Trend Micro and Kaspersky had proactive detection for none of these threats, leaving them at risk until the vendors could provide a signature update. McAfee customers were only protected from a single virus without updating. ESET’s NOD32 customers were protected four times more often against new viruses, and 95% more often across all new samples used in the test, including In-the-Wild threats, backdoors, Trojans and other malware. This is the second study conducted by AVComparatives.org on this topic in 2005. Over the course of both studies, NOD 32 proactively detected 50 out of 59 In-the-Wild samples used, or 85%. More details can be found at http://www.av-comparatives.org/ The graph shows the accuracy of heuristic-based detection and the performance of several antivirus vendors' products. The data is derived by determining whether or not a given antivirus product detects a new virus without requiring a signature update. If it does, then heuristic detection has succeeded (note: in some cases, well-written signatures can detect future variants).

VirusTotal.com
This independent consulting firm based in Spain performs real-time analysis of malware outbreak detection across a wide range of antivirus vendors. And as you can see from the graph below, NOD32 has by far the highest detection rate, and the fastest performance (tested separately by Virusbulletin). In fact, NOD32 is on average, 2-10 times faster than the competition.

See the table below for complete accounting of how antivirus vendors products detected major worm outbreaks