AV-Lab's test of FREE malware scanners

In the modern world, both individual and corporate users reach from time to time for software presented in the report. Due to the growing number of easy to detect generic threats and reviving samples of malware which uses malicious scripts, the role of traditional scanners is no longer as important as it was before. All applications tested by AVLab enable users to select scanning destination, which is verified against infected files. In the test, we haven’t included scanners which offer only so called quick check for the most important system areas because it doesn’t include user personal folders so verification of virus collection is impossible.

Malicious code developers who have access to advanced tools, readymade guides, and even cybercriminal services, don’t make task easier for experts seconded to hard analytical work. On the other hand, scanner designers find it very difficult to reconcile performance of these solutions and constantly increasing number of virus signatures. Traditional scanning techniques are being phased out in favour of more advanced, automated techniques with ability to learn threats patterns. In addition, some developers completely abandon on-demand scanners, and others make use of cloud model, leaving the functionality to scan only the most important system areas (drivers, registry, and running processes).

Source: https://avlab.pl/sites/default/files...canners_EN.pdf

None of the above comes even close to 100%, that is the reason, why it is advisable to have 2-3 on-demand scanners at hand. As for Windows Defender and Malwarebytes, well no surprise there.

This appears to be a random selection of after the event recovery tools I will always prefer to use an industry standard comparison site of full suites

http://chart.av-comparatives.org/chart1.php is one of the most trusted

TairikuOkami said:

None of the above comes even close to 100%, that is the reason, why it is advisable to have 2-3 on-demand scanners at hand. As for Windows Defender and Malwarebytes, well no surprise there.

I wonder in a multi-layered approach which would give 100% though...
WD + MBAM are often touted here as a combo - IF those results were mutually exclusive then I'd say OK... otherwise, nah )

I find Kaspersky rootkit scanning quite unobtrusive and resource friendly (having been a long-time Bitdefender fan, quite impressed so far with it)

BTW: What happened to Arcabit? did it get gobbled up by malware on Day 3?

Superfly said:

BTW: What happened to Arcabit? did it get gobbled up by malware on Day 3?

Due to the significant and continuous increase in number of Arcabit Skaner Online users, developer has decided to optimize scanning mechanisms which allow you to detect and remove all infections as quickly as possible, regardless of the number of files. The newest version of Arcabit Skaner Online offers single, optimized mode for scanning system resources, so it takes just few minutes to check active processes, services, drivers, and libraries for infections. Custom folders scanning feature is no longer available, so it was impossible to continue the test.

torre said:

In this chart, what does "user dependent" (gold bar) actually mean ?

Something, that behaves suspiciously and the user has to decide, whenever he trusts it or no. It might or might not be a malware. Lets say, that you open a document and it warns you, that macros are dangerous, it is up to to run it or not.

TairikuOkami said:

Due to the significant and continuous increase in number of Arcabit Skaner Online users, developer has decided to optimize scanning mechanisms which allow you to detect and remove all infections as quickly as possible, regardless of the number of files. The newest version of Arcabit Skaner Online offers single, optimized mode for scanning system resources, so it takes just few minutes to check active processes, services, drivers, and libraries for infections. Custom folders scanning feature is no longer available, so it was impossible to continue the test.

Hmmm.... doesn't lend much cred to the test then