Proving the importance of up-to-date certification and performance testing, Command AntiVirus, a historically strong scanner, failed to make the first cut with sub-par detection rates of only 90.91% for boot sector viruses, 98.11% for macro viruses, and 96.55% for script viruses. Other products disqualified for less than 100% ItW detection included AntiVir Personal Edition, Avast!, Bullguard, Dr. Web, eScan 2003, F-Secure, MkS_Vir, Power AV XP, Proland Protector, QuickHeal, ViRobot Expert, VirusBuster, Virus Utilities and V3 Pro Deluxe 2002.
Certain products passed the testing, achieving 100% detection of ItW threats, but had glitches in their programs that could lead to infections not being removed properly, system instability, or otherwise leave users at heightened risk. For example, AntiVirenKit (AVK) was unable to delete or rename the VBS/Stages worm, leaving the infected file accessible on the system.
Similar problems occurred with Kaspersky Antivirus and RAV. ZeroKnowledge, purveyors of Freedom AntiVirus had a more insidious glitch. If a large number of infected files had been found, every file scanned thereafter would be deemed to be infected and handled accordingly. In other words, if the action were configured to delete infected files, perfectly legitimate and clean files would be erroneosly accused and summarily deleted by the scanner. Such a glitch could lead to a non-functioning system or other after-effects more dastardly than the original infected files intended. It, too, was disqualified.
Both AVG and eTrust AV (VET engine) performed poorly on zoo detection, at 68.22% and 78.34%, respectively. It should be noted that eTrust AV with the CA engine performed admirably, with one of the best zoo detection rates of 94.39%. Despite that, eTrust AV (CA engine) was also disqualified due to numerous installation and program glitches, one of which affected the on-access scanner in Windows XP. Sophos was also disqualified due to a bug affecting Windows 2000/NT/XP which prevented its scanning directories on Linux/Samba servers containing an "!" in the directory name.
Next: The final cut
