Selection of malicious programs for the testing antivirus products for the treatment of active infections.

For the purposes of testing antivirus programs for the treatment of active infections, the expert group from Anti-Malware.ru selected 10 malicious programs based on the following criteria:

1. Detection of the parent file by all of the antivirus solutions tested.
2. Ability to mask the malicious program’s presence in the system.
3. Ability to interfere with the installation and operation of the antivirus solutions.
4. Ability to recover after deletion some program components.
5. All malicious programs had to be sufficiently widespread and well known.

During the selection of the malicious programs to be used for testing, preference was given to the most sophisticated samples that met the above criteria to the greatest extent.

It should be noted that a critical parameter for the selection of the malicious programs to be used for testing was the detection by all antivirus products tested of the malicious programs selected.

All of the malicious programs used for testing were in the wild samples, i.e., they were collected as they spread over the Internet (in the wild).

The following malicious programs were selected for analysis (the Kaspersky Lab classification is used here):

1. Adware.Win32.Look2me
2. Adware.Win32.NewDotNet
3. Backdoor.Win32.Haxdoor
4. Trojan-Proxy.Win32.Xorpix
5. Email-Worm.Win32.Scano
6. Email-Worm.Win32.Bagle
7. Trojan-PSW.Win32.LdPinch
8. Worm.Win32.Feebs
9. Trojan-Clicker.Win32.Costrat
10. Trojan-Spy.Win32.Goldun

Each malicious program sample was tested for correct installation and operation on the test system.

Until publication of the results of this test, the list of malicious programs was kept secret and was not provided to any of the vendors whose antivirus products were used.