Awards Guide for Rootkits Detection and Removal Test (April 2010)
As in all the previous anti-rootkits tests, their efficiency was evaluated on the basis of awarding definite points for detecting/deleting every rootkit.Â
At that, the maximum for every detecting/deleting case is 1 point. We took into consideration detecting any system anomalies (with 0.5 points awarded) and a possibility for infection cleaning (0.5 points more).
 In some cases a rootkit could be deactivated by deleting a file or by deleing a register key. A deactivating method did not influence the points awarded. Anyway, in case of successful rootkit deactivation an anti-rootkit was awarded 0.5 points even if both the file and the key or only one of them was deleted.
A malware component (rootkit) copying ability was not taken into consideration but considered only as an additional characteristic of the product abilities. Â
Important! An exception is made for system drivers infecting rootkits (Max++, Virus.Protector, TDL3 and z00clicker). If anti-rootkits managed to copy their infected content for analysis they were awarded 0.5 extra points (with the total of 1 point for infected content detection and deleting).
By analogue, anti-rootkits were awarded 0.5 points for MBR (Sinowal) infected file restoring (with the total of 1 point for the original MBR detection and deleting).Â
When striking the balance, all the points awarded are summarized. The anti-rootkits that won the most points receive awards when meeting the following requirements:
| The Platinum Anti-Rootkit Award is awarded if the product gets more than 95% of the total available points. | |
| The Gold Anti-Rootkit Award is awarded if the product gets more than 80% of the total available points. | |
| The Silver Anti-Rootkit Award is awarded if the product gets more than 60% of the total available points. | |
| The Bronze Anti-Rootkit Award is awarded if the product gets more than 40% of the total available points. |
If the anti-rootkit program gets less than 40% of the total available points, it failed the test.
Â
