Make Money

• The test was made on 23 April-10 May 2007, using Windows XP Professional SP2 on a P4 3000 Mhz, 1024MB DDRAM.
• All programs tested had the latest versions, upgrades and updates and they were tested using their full scanning capabilities e.g. heuristics, full scan etc.
• The default settings of each program were not used, in order for each program to achieve its maximum detection rate. Because of this, there is a possibility for the tested programs to detect a few false positives.
• All programs were updated on 22 April 2007, between 10.00AM and 13.00PM GMT.
• The 174770 virus samples were chosen using VS2000 according to Kaspersky, F-Prot, Nod32, Dr.Web, BitDefender and McAfee antivirus programs. Each virus sample was unique by virus name, meaning that AT LEAST 1 antivirus program detected it as a new virus.
• ALL virus samples were unpacked and the only samples that were kept were the ones that were packed using external-dos-packers (that means not winzip, winrar, winace etc).
• The virus samples had the correct file extension using a special program (Renexts) and were unique, according to checksum32 filesize.
• Most "fake" virus samples were removed, as well as "garbage" files.
• The programs MKS_VIR , PER and IPArmor were not tested because there was no english demo version available.
• The programs Anti-Hacker Expert , Command , Extendia AVK , GDATA AVK , BOClean , UNA , VET and Freedom were not tested because there was no demo version available.
• Thorough mode was not used in VBA32 due to extremely slow scan process.
• A-Squared Anti-Malware and eTrust PestPatrol are anti-trojan/anti-spyware programs, not antivirus programs
• F-Prot was tested using its command line scanner (options /adware /applications /report /streams /maxdepth=4 /heurlevel=4) because its GUI kept crashing.
• Windows Live OneCare, BKAV, PC Tools kept crashing while scanning the samples.
• TheShield uses the exact same engine as VirobotExpert.
• Avira uses the exact same engine as AntiVir.
• Fire uses the exact same engine as Solo.
• MKS_VIR uses the exact same engine as ArcaVir.
• VirusBuster uses the exact same engine as Vexira.
• BullGuard uses the exact same engine as BitDefender free edition.
• Avast Professional uses the exact same engine as Avast free edition.
• AVG Anti-Malware uses the exact same engine as AVG Antivirus free edition plus the Ewido scan engine, so it has better detection than AVG Antivirus free edition. (More information here )
• A-squared Anti-Malware Professional uses the exact same engine as A-squared free edition.
• InVircible did not include a "typical" scanner-function and could not be tested.
• V-Catch checks only mail accounts and could not be tested.
• DOS-Based scanners were not tested.

The following file types were used.

SH, ELF, COM, EXE, PL, BAT, PRC, DOC, XLS, BIN, MDB, IMG, PPT, VBS, MSG, VBA, OLE, HTM, INI, SMM, TD0, REG, CLASS, HTA, JS, VI_, URL, PHP, WMF, HLP, XML, SCR, PIF, SHS, WBT, CSC, MAC, DAT, CLS, STI, INF, HQX, XMI, SIT.

The virus samples were divided into these categories, according to the type of the virus :

• File = BeOS, FreeBSD, Linux, Mac, Palm, OS2, Unix, BinaryImage, BAS viruses, MenuetOS.
• MS-DOS = MS-DOS viruses.
• Windows = Win.*.* viruses.
• Macro = Macro, Multi and Formula viruses.
• Malware = Adware, DoS, Constructors, Exploit, Flooders, Nukers, Sniffers, SpamTools, Spoofers, Virus Construction Tools, Droppers, PolyEngines.
• Script = ABAP, BAT, Corel, HTML, Java, Scripts, MSH, VBS, WBS, Worms, PHP, Perl, Ruby viruses.
• Trojans-Backdoors = Trojan and Backdoor viruses.