Win32 Virus Removal

Jayaraman Kesavardhanan (nicknamed "keseven") founded Chennai-based K7 Computing in 1991, and the company just celebrated achieving 10 million users. Most of those users are in Asia, though. The company isn't well-known in the U.S. K7 Antivirus Plus 11.0 ($39.96, direct) may grab more mindshare for the company; it's an impressive antivirus application with some nice additions.

The product installs quickly, and its flame-orange color scheme stands out from the crowd. It doesn't specifically run a pre-install or on-install scan the way avast! Free version 6.0 (Free, 3.5 stars), Ad-Aware Pro Internet Security 9.0 ($29.95 direct, 4.5 stars), and others do. However, on all but two of my malware-infested test systems its real-time protection detected active threats immediately after install and requested a reboot to fully remove them.

Fair Scores from Independent Labs
AV-Test.org didn't include K7 in its recent rounds of antivirus certification testing, but four other labs have tested K7's technology. In the latest on-demand and proactive tests by AV-Comparatives.org it scored STANDARD and ADVANCED respectively; ADVANCED+ is the highest rating. In both tests it suffered many false positives (valid files identified as malicious). K7 achieved VB100 (100% detection) in 7 of the last 10 tests by Virus Bulletin.

Overall the labs give it a fair rating. F-Secure, Symantec, and several others have scored much better on these independent lab tests. The chart below summarizes test results for the current crop of antivirus programs. For details on how I derived this summary, see How We Interpret Antivirus Lab Tests.

Fast Two-Part Scanning
By observation, K7 focuses on wiping out the active, executable files that comprise the heart of any malware threat. In its default configuration, it doesn't even try to find Registry traces or non-executable files. For testing I checked the boxes to scan for "unwanted files" and "unwanted Registry Entries."

On my standard clean test system a complete scan took under 20 minutes. The average is closer to 30. Norton AntiVirus 2011 ($39.99 direct, 4.5 stars), G Data AntiVirus 2011 ($29.95 direct, 2.5 stars), AVG Anti-Virus Free 2011 (Free, 3.5 stars) and others use various techniques to dramatically reduce the time required for subsequent scans. With K7 a second scan took the same (relatively short) time.

The full scan checks for known malware threats that use rootkit technology, but if you want to check for unknown rootkits based on behavior you need to run a quick separate scan. I ran that scan after the complete scan on each test system that included one or more rootkit samples. All but one came up clean; K7 detected and removed a rootkit from the eighth. I'd definitely advise running this scan after your first complete scan with K7. It only takes a couple of minutes.

On finishing a scan K7 reports on what it did, listing all the traces it found individually. I prefer a report that pulls together traces from the same threat. K7 automatically took action to remediate active threats but left the non-executable file and Registry traces alone, marking them as "riskware." I selected them all and tried clicking Delete; nothing happened. Quarantine was likewise ineffective. It turns out that you must click Clean to get rid of these traces.

Excellent Detection, Limited Cleanup
K7 detected 97 percent of my malware samples. The combined power of Norton 360 Version 5.0 (Free, 4.5 stars) and Norton Power Eraser (Free, 4 stars) also detected 97 percent, but no other single product did as well against the current crop of samples. Double Anti-Spy Professional v2 ($29 direct, 4 stars) came closest, with 94 percent.

Unfortunately, K7 didn't do a good job cleaning up what it found. It left behind executable traces for 12 percent of the threats it found. I don't count uninstallers as executable files that must be removed; if I did that figure would rise to over 30 percent.

For a quarter of the samples detected it removed all executables but left behind over 90 percent of non-executable traces. As a result its overall score for malware removal was 7.5 points. Double Anti-Spy got 7.6 and PC Tools Spyware Doctor with AntiVirus 2011 ($39.95 direct for three licenses, 4 stars) earned 7.8. Despite detecting a lower percentage of the threats, better cleanup puts Norton 360 and Norton AntiVirus at the top in this test, with 7.9 points.

I break out a separate score for each product's removal of threats using rootkit technology, some of which are commercial keyloggers not counted in the overall malware removal score. Like quite a few others, K7 detected 100 percent of these. One sample remained fully functional as a rootkit even after the rootkit-specific scan finished. K7 left behind significant traces for several other rootkits, coming in with 7.6 points. Norton 360 scored 8.4 in this test, while Spyware Doctor beat all the rest with 9.1 points.

Looking specifically at scareware (rogue security software) K7 detected 88 percent and scored 6.9 points. Ad-Aware Pro is the champ for this test with 8.4 points. For full details on how I derive these scores see How We Test Malware Removal.

This entry passed through the Full-Text RSS service — if this is your content and you're reading it on someone else's site, please read our FAQ page at fivefilters.org/content-only/faq.php
Five Filters featured article: Comment Is Free But Freedom Is Slavery - An Exchange With The Guardian's Economics Editor.