Thompson Cyber Security Labs published a study according to which, amongst current desktop security software, Symantec's Norton AntiVirus 2007 suite is the best at detecting and removing stealth rootkits.
In the study, which was commissioned by Symantec and conducted by veteran anti-virus expert Roger Thompson, 20 arbitrarily selected pieces of rootkit-laden malware files were used against the major anti-virus and anti-spyware vendors to scale detection and elimination capabilities.
In both categories, Symantec's Norton came out tops, although the tool did not fully get rid of all 20 rootkits.
The application that performed the poorest, according to Thompson, was Microsoft's Microsoft Windows Defender (Beta 2), which is being built into the Windows Vista operating system.
In the detection section, Thompson tested the software's capability to find a rootkit after it is installed on a workstation. If a particular rootkit is not detected, it could be due to either engine boundaries or missing detections for a particular version of the rootkit, according to the report released by Symantec on Nov. 3, here in PDF form
The software suites were rated individually on remediation capabilities, which tested the ability of the product to remove the components so that the rootkit is no longer left running on the system, as well as the ability of the product to completely remove the side effects of a rootkit, including registry keys.
In the discovery class, Symantec Norton scored the highest, followed by McAfee Internet Security 2006, Webroot SpySweeper, F-Secure Internet Security Suite 2006 and Sunbelt CounterSpy.
Microsoft's Windows Defender only spotted five of the 20 rootkits.
In the clean-up category, Symantec also scored the highest, well ahead of Webroot, F-Secure, McAfee, Sunbelt and Microsoft.
Nevertheless, affording to Thompson's findings, most of the security tools did not fully remove more than half of the rootkits. Sunbelt, Microsoft and Trend Micro deleted only five of the 20 rootkits.
|
