i've been doing some amateur (i.e. meaningless) testing.
i started with 440 simple infectors. FireLite did the worst, only
finding 405. BitDefender did a bit better, and Escan found 421. i was
most impressed with Kaspersky which found 429. either the remaining 11
are lesser known, or i may have some corrupted samples.
the interesting part is that Escan uses some variant of the KAV engine,
yet KAV Personal 5 beat it by a good margin.
I suppose you've made sure scan options settings are identical? And
both are downloading either "normal" updates or extra defs?
My own comparisons of this kind have been done with several thousand
malware samples of various types and in various "containers" with
various runtime packers involved. Usually, I compare KAVDOS32 build
135 with the GUI version 3.5 of KAV. Results have always been
identical. I have seen discrepancies when comparing to Antidote which
uses the KAV engine. Antidote always misses a few that the others
detect for some unknown reason. I haven't compared later KAV GUI
versions. It's possible, of course, that later GUI versions may have
different detection characteristics than earlier versions to some
extent.
Insofar as "amateur" testing goes, there's nothing unscientific or
unprofessional about comparison checks using questionable malware
samples, since you're simply looking for _differences_ in detection.
You're not drawing any conclusions about scan engine quality. That can
only be done using _viable_ malware samples.
And I can't say that since two different KAV scanners agree
identically in detection that they would agree on all possible
samples, since I obviously don't have all possible samples
I can,
however, detect when some major or significant change occurs, such as
an older build or version not detecting newer XYZ type of malware
currently in circulation. That happened a few years ago with the old
AVPLITE for DOS. It couldn't detect some newer script malware that
KAVDOS32 could detect.
Art
http://www.epix.net/~artnpeg