Labs

Anti-virus software

All our security tests are run in a purpose-built, secure lab. The target systems are standard Windows XP Professional Edition PCs with the latest Microsoft updates and the default settings enabled. An anti-virus program is installed on each and updated to the latest virus definitions and other updates. We don't change the default settings, so our test results show how effective the programs are for regular customers who don't want to mess around with advanced security options.

We tested each program's ability to detect viruses, Trojans and spyware. We ran two sets of tests. The first test aims to see how effective each product is at detecting email viruses, a huge threat to PCs in homes and small businesses. The second uses spyware and other web-based threats.

The email virus test

We obtained samples of viruses collected by the email scanning systems at MessageLabs. One way that these detect viruses is to look at patterns in email traffic. This makes it possible to discover new viruses without having to spend a long time testing each file.

All 251 of these real-life viruses were spreading across the internet at the time that we ran our tests. Each file had been detected in the wild within the previous two weeks. The target systems each used Outlook Express to download every virus from our virus email server. Each virus was attached to a separate email message. We observed how the anti-virus software handled infected messages and counted how many it detected.

The spyware test

Just before starting the tests we downloaded 183 malware programs from the web. These malicious files were stored on a web server in our lab and each target system was programmed to download the files over the network. Most anti-virus programs should detect infected files as they are downloaded or, at the very least, as soon as they are saved to the hard disk.

To make the test as fair as possible, we waited until the anti-virus software on each target system had finished, then ran a manual scan against the remaining, undetected files. The detection rate for spyware is the combined result of the web scanner and the manual scan.

The results

Our graphs show three results for each product: the percentage of email-borne viruses it detected, the percentage of web-based threats it identified and the average percentage. As the graph shows, all the products tested here are significantly better at finding email viruses than they are at handling spyware. The overall average for email virus detection is 76 per cent, while web-based threat detection is 32 per cent.