ARE WE EVER SAFE?

Why popular antivirus apps 'do not work'By Munir Kotadia, ZDNet Australia21 July 2006 04:38 PMAntivirus applications from Symantec, McAfee or Trend Micro -- the threeleading AV vendors in 2005 -- are far less likely to detect new virusesand Trojans than the least popular brands.This has nothing to do with the quality of the software or how long ittakes the respective firms to update their clients with signatures andother malware countermeasures.AV companies continue to refine their products and most will tell youthey stopped relying on purely signature-based systems many years ago.These days they use all sorts of clever methods to try and detectsuspicious behaviour but the problem is that malware authors are alsovery clever. Very, very clever.On Wednesday, the general manager of Australia's Computer EmergencyResponse Team (AusCERT), Graham Ingram, described how the threatlandscape has changed -- along with the skill of malware authors."We are getting code of a quality that is probably worthy of softwareengineers. Not application developers but software engineers," saidIngram.However, the actual reason why the top selling antivirus applicationsdon't work is because malware authors are specifically testing theirTrojans and viruses to make sure they can bypass these applicationsbefore releasing them in the wild."The most popular brands of antivirus on the market… have an 80 percentmiss rate… So if you are running these pieces of software, eight out of10 pieces of malicious code are going to get in," said Ingram.Although Ingram didn't mention any of the leading losers by name,Gartner's figures for 2005 show that Symantec is the clear leader with53.6 percent of the market. McAfee and Trend own 18.8 percent and 13.8percent of the market respectively.One vendor Ingram did mention was Russian outfit Kaspersky, which in thesame tests managed to block around 90 percent of new malware.According to Gartner, Kaspersky's market share is a lowly 0.7 percent.Most large firms already use more than one antivirus application but Iwonder how many use two of the Symantec, McAfee and Trend trio? If you do then I suggest investing in yet another -- but whatever youdo, stay well away from the bestseller shelf.