First of all I want to thank Matt for all the nice reviews!
Yesterday I installed KIS 2010 to test it and I have one question regarding the KIS 2010 review part 2. Matt says that he did not get any malware past KIS. The problem is that he did not really test the behavioral part of KIS at all. By stating that the heuristics part did not recognize some of his 0-day malware links and tagged them as low-risk, Matt just told KIS to put anything it does not know about into the “untrusted” category. This means that any file not known by KIS is tagged as “untrusted” – but this was Matt’s decision, not KIS. And there are a lot of files out there KIS does not know about wich are 100% clean so it is not possible to handle any unknown file as “untrusted”. So form my point of view in his review it was Matt who decided what is malware and not KIS. To test KIS he should have run the untrusted password hijackers to see if the behavioral check catches them or not. Or do I misunderstand something?

Best regards,
Anguel

Nowadays I recommend Avira to normal customers. I’d like to recommend F-Secure too, it’s very powerful, but DeepGuard requires too much interaction for normal users in order to be truly effective. I don’t know. It seems to me that antiviruses are going in the wrong direction. All they care about is a graphical advanced GUI and just pack more and more features. I think the most important thing would be to maximize the signature and heuristic detection abilities first, then start thinking about this. Like Avira. They’re signature and heuristics are great, they just need some HIPS. Or F-secure. The Kav engine + F-Secure’s own engine is really effecive. Their HIPS (esp. in v 2009) is a real beast too. All they need is to make the HIPS smarter and to lower memory usage.

Returnal
Geswall
Secunia

On top of kaspersky 2010

As most of you probably know that kaspersky has got a sandbox feature now in the 2010 version so i though i dont need a
sandbox application but what i understand you can not rely on a sandbox alone as the malware is still floating free in you system
so damage is still possible even though its in a sandbox it still has rights to run and rely on the end user to know what they are doing
this was the reason for Geswall isloation choice
rather then virtulasion As correct me if im wrong but isloation is better than virtualsation for the same reason where the
malware still has rights in a virtulasied area so damage is still possible

With rentuil the drive is still vulrubale to malware right? The one returnil creates am i also right? So this defeats the object?

returnil does not proctection tatoo partion am i right? Or a Pc with a preinstalled operating system with back up partition?

web of trust brongs up returnil as unsafe website how weird?

Also will geswall and kaspersky together conflict i got a pdm keylogger could this be down to geswalll

kas was found to have a vulntbity thats allows to be disabled remotely or loacla by running a script fix was released
better to hve one hip one av virtul brwser instead of all in one prgrme

You can do similar things with Returnil indeed, but it’s not the same protection.
1. Sandboxie isolates the malware and makes it harmless immediately (= security).
2. Returnil without Sandboxie let the malware install itself and do its evil job.
Returnil will remove the malware indeed during reboot, but way too late.
In other words Returnil without Sandboxie = no protection, just good removal (= recovery, not security).

Please can you clarify if these statements are true Many thanks

http://malwareresearchgroup.com/?page_id=2

Kaspersky got 4th position behind A-Squared, Avira and GData. Take a look!