Win32 Virus Removal

You want antivirus protection that's tough on malware and tenacious like a bulldog, right? BullGuard certainly hopes you're attracted by the bulldog motif of BullGuard Antivirus 10 ($29.95, direct). To sweeten the deal they've thrown in a full antispam component along with protection against phishing and malware-hosting sites. The extras are nice, but they don't make up for the product's pallid performance in tests, both mine and those of the independent labs.

With its big buttons, blocky icons, and a red and white color scheme the product looks tough. It doesn't use color to indicate security status, but clicking the Status and Settings button brings up a list of any configuration problems and an offer to fix them.

BullGuard is tough on the bad guys but works hard to make things easy for you. In its "as quiet as possible" mode, the app limits popup warnings to those that require action on your part, suppressing any that are just informational. Access to e-mail or live chat help is built right into the product, and its message center keeps track of your tech support interactions automatically.

Failure to Launch
I found myself making significant use of the product's support options just to get it fully installed. On two of my malware-infested test systems it stalled just short of completing installation with an "unexpected problem." It did automatically send diagnostic information to the company, along with my brief note describing the problem.

One technician pointed out that even when the full user interface won't load, you can still scan any folder by right-clicking it. That didn't work in practice, however; the program reported an error on both problem systems.

Another technician advised using ComboFix, a free cleanup tool distributed by BleepingComputer.com. ComboFix did the job, allowing BullGuard to fully install, but I would have been more impressed by an all-BullGuard solution. McAfee has its Stinger tool, Symantec has Norton Power Eraser, and many vendors offer a rescue CD to wipe out persistent malware that interferes with installation.

Labs Not Impressed
I rely on a variety of independent labs for test results at a scale bigger than I can manage myself. West Coast Labs doesn't test BullGuard, though, nor does AV-Comparatives.org. BullGuard received the VB100 award seven of the nine times Virus Bulletin tested it; they included BullGuard for the first time in 2007. That's good, but quite a few other products have participated with Virus Bulletin for ten years or more and achieved VB100 in all ten of the last ten tests, among them AVG, ESET, F-Secure, and Symantec.

German lab AV-Test.org has published quite a few original tests in the last year or so, but only the Windows 7 certification test from August 2010 included BullGuard. This test assigned products up to 6 points each for disinfection, protection, and usability and required a total of 12 points for certification. With 10.5 points, BullGuard didn't make the cutoff. The top products in this test, Kaspersky, Norton, and Panda, scored a total of 16 points, with no individual score below 5.0.

From the lab results, it seems clear that BullGuard doesn't rank with the best. Results of my own hands-on tests agreed.

Many Traces Left Behind
As noted, I had to use the third-party tool ComboFix to get BullGuard installed on two of the test systems. Out of all the samples only three were removed completely, down to the last data file; ComboFix was responsible for two of those.

Most of BullGuard's own detections removed the executable files and left 100 percent of the non-executable file and Registry traces—many hundreds of traces for some. In a few cases, it did leave behind some executable malware files as well. Unlike eScan Anti-Virus 11 ($29.95 direct, 3 stars) it didn't leave any of them actively running, which is a plus.

BullGuard detected 76 percent of the malware threats, which is significantly below average, and scored 6.3 of 10 possible points for malware removal. Norton AntiVirus 2011 ($39.99 direct, 4.5 stars) and PC Tools Spyware Doctor with AntiVirus 2011 ($39.95 direct for three licenses, 4 stars) top this test with 7.9 and 7.8 points, respectively.

In a separate test using commercial keyloggers in place of malware BullGuard detected 71 percent of the threats. It left behind executable files for almost all of those it detected, with three still running and two actively hiding using rootkit technology. At 3.6 points, its score for keylogger removal is dismal, though I don't give this score much weight in the final evaluation.

BullGuard detected all of the rootkit samples (drawn from both the malware and keylogger collections). Seven other recent products have also managed 100 percent detection. Two of the rootkit threats were completely wiped out by ComboFix and one mostly eliminated by BullGuard. It left behind executable files for all the rest; three were still running. As for scareware (rogue security software), BullGuard's 50 percent detection rate and score of 4.3 points were both near the bottom.

For full details on how I test malware removal and derive these scores see How We Test Anti-malware.

For all its tough style, BullGuard doesn't detect as much malware as most of the competition and doesn't thoroughly remove what it does detect. I wouldn't rely on it to clean up an infested system.