Dark Reading

Oh, antivirus products. They're a commodity item, right? They're all pretty much the same.

Wrong, according to a live test of antivirus products for Linux conducted last night at the LinuxWorld event in San Francisco.

In an antivirus "fight club" conducted in front of an audience by network gateway vendor Untangle at the show, 10 antivirus products were confronted with 25 viruses, many submitted by members of the audience. The goal: to see whether the AV tools would catch 'em all.

The results: Only three of the antivirus tools caught and blocked all 25 viruses thrown at them. One tool caught fewer than 10 percent.

"What's surprising about a test like this is how much difference there is between the antivirus products' performance," says Dirk Morris, CTO and co-founder of Untangle. "Some of the products you think will do well don't, and some of the lesser-known products, like open source tools, end up doing well."

The "winners" in last night's contest were Linux tools from Kaspersky and Symantec, and the open source Clam AV. All three tools caught 100 percent of the viruses they encountered. FProt and Sophos caught 94 percent; McAfee caught 89 percent; and GlobalHauri, Fortinet, and SonicWall caught 61 percent.

One product, WatchGuard's Linux AV tool, caught fewer than 6 percent of the viruses sent to it. "We're not exactly sure what the problem with WatchGuard is," says Morris. "The test was set up the same way for all of the vendors."

WatchGuard disputes the test results, stating that it uses ClamAV -- one of the products that caught all of the viruses -- in its own product. "We don't see how the results could be valid -- our product uses ClamAV," a spokesman says.

Untangle first conducted the AV "fight club" two years ago, when it was trying to decide which AV tool to include in its network gateway, which offers a variety of security and network performance tools. "It's a simple test," Morris says. "We just wanted to see which tools worked best."

For last night's test, Untangle accepted viruses submitted by audience members and other interested parties, and its test set is available online. No zero-day exploits were included. "Most of these are everyday viruses. Some of them have been around for years," Morris says. "These are all things that an antivirus tool should catch."

— Tim Wilson, Site Editor, Dark Reading