Win32 Virus Removal

G Data may not be a household name among American consumers, but it's very well known in the security community. Founded in 1985, this German company would love to gain more market share in the U.S. In my own malware detection tests and independent lab tests G Data AntiVirus 2012 ($49.95 direct for three licenses) scored very well. I did find it less effective at thoroughly cleaning up already-infested test systems than at keeping a clean system clean, though, and getting it installed on infested systems was a real ordeal.

Good Lab Results
G Data's antivirus technology makes a fine showing in independent lab tests. ICSA Labs certifies its virus detection accuracy, and it received the VB100 award in nine of the last ten tests by Virus Bulletin. In the latest tests by AV-Comparatives.org, it rated ADVANCED+ for proactive detection and ADVANCED for on-demand detection.

AV-Test.org is running an ongoing series of antivirus certification tests under Windows XP, Windows Vista, and Windows 7. 11 total points out of a possible 18 are required for certification. G Data passed handily, receiving 15.0, 13.5, and 14.0 points in the three tests.

Individual scores for detection, cleanup, and usability go into the AV-Test totals. It's worth noting that in all three cases G Data's repair score was the lowest of the three. My own tests showed it to be better at keeping malware out of a clean system than at removing already-entrenched malware.

The chart below summarizes test results for the current crop of antivirus programs. For details on how I derived this summary, see How We Interpret Antivirus Lab Tests.

Installation and Boot CD
Getting the product installed on my twelve malware-infested tests systems was something of an ordeal. On these underpowered virtual machines the install took quite a while to unpack and run. After a required reboot, each needed a while longer for the necessary initial update.

That was for the systems on which G Data installed without problems. On three of the test systems, malware completely prevented installation. Three other systems locked up during the install process, after the reboot stage.

G Data won't install or scan in Safe Mode, but the company does make a Boot CD available to handle problems like this. In fact, the product itself contains a wizard that will handle creating and burning a fully up-to-date Boot CD.

Running a scan with the Boot CD did allow me to install the product on all six problem systems. I set it to disinfect files if possible, quarantine if not. In some cases it quarantined dozens of infected files, wiping out Firefox and parts of Microsoft Office! I expected it to remove the virus, not the entire infected file.

Better Detection than Cleanup
Once I finally had G Data installed on all twelve test systems I ran a full scan on each. This initial scan takes a while, because it marks each clean file to be skipped on subsequent scans. On my standard clean test system the initial scan took 40 minutes while a second scan barely needed 40 seconds.

When the scan finishes G Data lists the traces it found along with its recommended action. In most cases it recommended "disinfect (if not possible, quarantine)." For all of the test systems I chose to execute the default actions. On completion it reported what it did. All of the systems that hadn't been pre-cleaned by the Boot CD (and a few that had) needed a reboot to finish their cleanup.

This is only the second product tested with my 2011 malware collection, and the first was avast! Rescue Disc ($10/once direct, 3.5 stars), which is a cleanup-only CD-based product. G Data's scores don't necessarily compare directly with those in earlier tests. One thing is very clear; it's significantly better at detecting threats than at thoroughly removing them.

G Data detected 83 percent of the malware samples. That's good, but nowhere near the 97 percent achieved by K7 Antivirus Plus 11.0 ($39.96 direct, 4 stars) or the 94 percent detection rate of Double Anti-Spy Professional v2 ($29 direct, 4 stars) (both using the previous set of samples).

G Data's relatively low removal score of 5.4 points reflects the fact that it left behind executable traces for over 40 percent of the threats it detected and left behind all non-executable threats for another 28 percent.

Looking specifically at rootkits, G Data detected 86 percent and scored 5.3 points. More than half of the products tested against the previous sample set detected 100 percent of rootkits. Spyware Doctor with AntiVirus 2011 ($39.95 direct for three licenses, 4 stars) led the pack with a score of 9.1 points.

I also break out a separate score for scareware (rogue security software). In this test G Data came up a winner. It detected 100 percent of the scareware samples and scored 8.4 points. No product detected 100 percent of the rogues in the previous collection. In particular, G Data AntiVirus 2011 ($29.95 direct, 2.5 stars) detected just 63 percent of last year's rogues and scored 4.5 points.

Getting my test systems cleaned up with G Data was a grueling experience. The lab tests mostly look at detection, and indeed G Data is good at detection. But as in the lab tests I found it less capable of full cleanup. For full details on how I derive these scores, see How We Test Malware Removal.

This entry passed through the Full-Text RSS service — if this is your content and you're reading it on someone else's site, please read the FAQ at fivefilters.org/content-only/faq.php#publishers. Five Filters featured article: If At First You Don't Succeed - Four Decades Of US-UK Attempts To Topple Gadafi.