AntiVirus Opinion

[bigdog]

Has anyone really tested the AV module of OSS? I have never even heard of Virusbuster before it was "officially reveled" and when I went to google it, the reviews were not too favorable. I wanted to see if it was worth installing or just use my current one

Thanks

[chrisclu]

I just use my current one (AVG) Don't even have the OSS AV installed (Just the Anti Malware)

[Rah]

I'm curious how you think you are disabling the AV in OSS and still having the Anti-Malware installed, since there is just one plugin. . . Anti-Malware . . . and it is both AV and Anti-Spyware and there aren't separate control mechanisms for them that I see. ??? I too have turned back on AVG AV, but assume the OSS AV is still running when the Anti-Malware scans are run (as well as the real time and on-demand from the shell).

[marcelg]

Seems interesting, i can use nod32 together because it crash, maybe i can disable the antivirus on the suite.

[pavement]

The antivirus seems ok to me, although I havent been able to carry out any testing comparable to anything official. I am currently in the market for a new av and the upgrade cost from Outpost Pro seems pretty good, so I want to like it!

I have tested a few av's in the past couple of months. Virus Buster does throw up a few false positives on suspicious files, but thats probably no bad thing. Its very difficult to say any more than that really.

I think people tend to get attached to their antivirus, not always for logical reasons. Resource usage is an issue for me so I want a lightweight av, which means that if I am already running Outpost as a firewall then the Security Suite is a good option. I have never been a big fan of suites, but I am starting to lean that way.

I would say the upcoming Eset suite is major competition for Outpost, if they get the firewall right. (The beta looks promising). I am a little concerned as to Agnitum's ability to provide the kind of update infrastructure on a day to day basis of the major av's, and I might hold off for a year until the Security Suite matures a little.

Pavement

[Manny Carvalho]

The suite has both VirusBuster's AV engine and Agnitum's antispyware engine. Since this is new there's no real track record yet. I suspect that it will be better then say the free AVG or even the stand alone Virus Buster. It's really hard to say at the moment since no real third party testing is available. A consumer really doesn't have the capabilities to run a proper AV test.

I agree with you Pavement, about people getting attached to their AV software. I certainly can't get rid of NOD32. But one thing is sure about a suite - the AV component will not have compatibility problems with the firewall. As software gets more complex, as OP v4 has done, that's certainly more of a problem nowadays.

Agnitum gets the AV signatures from VirusBuster so all they have to do is to get the synchronization right. Getting the signatures should be easy. The update process is getting a hotfix in the very near future in order to repair some of the problems we have been seeing. In my opinion the update process will soon be robust and have the capability to be done hourly.

As a big a fan as I am of NOD I'm not so sure that the ESET suite will be that much competition since their firewall just won't be able to match OP. A killer suite would have been a NOD engine with the OP firewall but this one is only in my dreams. I guess time will tell how big a competitor it will be.

[pavement]

I take on board what you are saying. I suppose I have some concerns about Virus Buster as a standalone company, and their long term viability, as well as how well they integrate with Agnitum. I know I am only buying a 1 year licence, but its important to know that a product will still be there in a few years. I am long enough in the tooth to have wasted a fair bit of time on short lived products. :) As I say, I am a massive fan of Outpost and want to see the suite succeed.

With regards to competition, it is difficult to see a point when Agnitum will be competing with the likes of Symantec, mcAfee, Panda etc. I think their products are aimed at a different type of user.

I think in some ways Eset, Agnitum, and to an extent Kaspersky, are chasing after the same customers. Not being a beta tester, I was really hoping that the OSS av would be Eset, Kaspersky or even Bitdefender. Having said that I am happy to give Virus Buster a chance. It is important though that they get the updates sorted quickly.

One thing I really like about Agnitum products is that I can buy them in US dollars so I know I am not getting ripped off, as is often the case when UK residents have to buy in pounds. (For example Vista costs twice as much in the UK.) Thats a big plus point for a subsription product.

Anyway, I still have the trial installed, so will continue to give feedback, good and bad!


Regards

Pavement

[insearchof]

With regards to the Virus Buster scan engine used by OSS 2007, it passed the quality testing of "Virus Bulletin". Virus Bulletin has carried out independent comparative testing of anti-virus products since 1998. Virus Bulletin's tests are widely recognized within the industry. The tests tend to focus on virus detection rates and scanning speed, as well as looking at how each product fares when scanning a set files that are known to be clean. You can get more info on Virus Bulletin and their test standards at http://www.virusbtn.com. To test the virus/malware scan engine in OSS 2007, try downloading the icar test file from http://us.trendmicro.com/us/support/virus-primer/eicar-test-files. There are two download links on the page, one for http and one for ftp. Try to save or run the file from both links. If you cannot, and the file gets quaratined, or blocked, or both, then the engine is functioning properly. I too am seeking a new security package which is why i am trying OSS 2007. To date, i have no issues other than having to allow extra long DNS requests to get to webmail. However, i do not use webmail so thats neither a big deal or a security risk. Hope this helps...

[newline]

For those who are interested, this may be the first test result - http://www.wilderssecurity.com/showthread.php?t=176496.

[Kurt W]

I know already, why I am not changed to the Suite and virus scanners AntiVir mean kept. :D

Failed:
-Agnitum
Result history: Agnitum
Product name: Agnitum Outpost Security Suite Pro 2007 5.1214.616

http://www.wilderssecurity.com/showthread.php?t=176496

[minoka]

Hi Kurt W,

Thanks for the link, but it has already been posted in this thread
http://outpostfirewall.com/forum/showthread.php?t=20494

To keep the discussion "together", I merged the threads.

Hope you understand.

[Kurt W]

Hi Kurt W,
Hope you understand.

Hello minoka,

No problem. ;)

Regards Kurt

[minoka]

Thanks again, Kurt!

[garry]

its firewall & antileak capability seems to be not doing very good either :(

www.matousec.com/projects/windows-personal-firewall-analysis/leak-tests-results.php

Outpost Firewall PRO 4.0 (1007.591.145) 6550 Good

[Paranoid2000]

its firewall & antileak capability seems to be not doing very good either :(It's rated as one of the best if you exclude their FPR results (Lavasoft, which seems to be using beta build 1019 of the Outpost engine is rated 4th). Whether FPR can be considered a valid test or not is a topic that has been extensively discussed elsewhere (http://outpostfirewall.com/forum/showthread.php?t=19438), so please post any further comments in that thread rather than take this one OT.

[garry]

ok, one question though, why you find the need to alter the url i provided?

[Manny Carvalho]

ok, one question though, why you find the need to alter the url i provided?We didn't alter but deactivated it. We do it due to past experiences with Matousec type discussions. Having an inactive link still allows people the freedom of expression but discourages the less then polite comments that we have seen in the past.

[yagood]

My OPF license expires in about 40 days and today I saw Agnitum News (special offer on OSS) and I decided to test it. So I Googled for "antivirus test" and stumbled upon "EICAR Standard Anti-Virus Test File". Unfortunately, OSS with up-to-date virus signatures database doesn't detect it as a threat. I know it's only one file and probably OSS's antivirus is/will be great, but NOD32 detects this file as a virus immediately after clicking on a download link...

Anyway, I'm still undecided if I should just renew my OPF license or try OSS for a year... main question is:

Is firewall module in OSS any different than OPF? I mean, Agnitum provides quite frequent updates to OPF and I wonder if OSS firewall module is going to be updated at the same time as OPF? Will any new features in OPF be also available in OSS?

I'm still going to use NOD32 as antivirus, so it's the firewall that concerns me the most now. Of course Anti-Malware module in OSS is a nice bonus, but I would like to know answers to these questions above. Thanks in advance!

[Manny Carvalho]

OSS will detect the EICAR file when it's executed. NOD's IMON module detects this file when downloaded. It's a different mode of operation but both prevent the file from being executed which is what is important for malware protection. In fact, all AV software will detect this file since it is an AV test file.

The firewall module is slightly upgraded in OSS at the moment but these two should be in synch soon. It's very likely that there will never be any significant differences in firewall engines in comparable versions of OSS and OP. To put it another way, the reason for purchasing OSS won't be because its firewall is better then the stand alone product. The reason is the integrated AV program.

[yagood]

OSS will detect the EICAR file when it's executed. NOD's IMON module detects this file when downloaded. It's a different mode of operation but both prevent the file from being executed which is what is important for malware protection. In fact, all AV software will detect this file since it is an AV test file.

Yes, I know that NOD has IMON, but I think OSS has the option to scan the files each time they are accessed (not only when they are executed) - with this option set, I managed to save the file, unzip the exectuable, view its contents, copy it etc. I didn't try to execute it though :-)


The firewall module is slightly upgraded in OSS at the moment but these two should be in synch soon. It's very likely that there will never be any significant differences in firewall engines in comparable versions of OSS and OP. To put it another way, the reason for purchasing OSS won't be because its firewall is better then the stand alone product. The reason is the integrated AV program.

And that's the reason why I'm considering it, I only had doubts about how the firewall module compares to OPF, but thanks for answering my questions. Now I'm probably going to give OSS a shot for a year :pirate:

[Manny Carvalho]

Yes, I know that NOD has IMON, but I think OSS has the option to scan the files each time they are accessed (not only when they are executed) - with this option set, I managed to save the file, unzip the exectuable, view its contents, copy it etc. I didn't try to execute it though :-)You may be right that there is an option to check on download. I'm not running OSS right now so can't check. I do remember though that somebody made a big deal out of this behavior and I vaguely recall that Agnitum added that feature. Perhaps someone with OSS installed can answer that question.

[Housi]

Hello
I'm a OP Firewall Pro user with lifetime license. For a test I've downloaded OP Security Suite 2007. After installing I made some tests, e.g. I did try to download the Eicar-festfile from http://www.rexswain.com/eicar.html. I could download this testfile without any troubles.
With active avast pro this is not possible, see attached screenshot. I think I'll stay with OP Firewall pro and avast.
Regards
Housi

[Manny Carvalho]

Hi Housi,

This is just a matter of philosophy when something gets detected. Malware isn't malicious until it's executed so until then it doesn't matter. OSS is able to detect the eicar test file with no problem but it will allow you to download it.

So it's not that OSS can't detect this file but when it detects it. I'm not trying to convince you one way or another. You should use whatever software you feel comfortable with.

[Housi]

Hi Manny
Thanks for your answer. I'll will stay with OP Pro.
Regards
Housi

[Manny Carvalho]

You are very welcome Housi.