WSA Best AV for 2012, according to PC Mag

I like the beginning but at the end they still don't understand how WSA journaling works! :@
 
"As for malware blocking, Webroot earned a perfect 10 of 10 points against the previous sample set while Norton got 8.9 points. Bitdefender, tested with the current sample set, also took 8.9 points. In independent lab tests, Bitdefender and Norton get very high marks. Webroot, with its non-traditional detection and remediation methods, doesn't fare as well in those tests."
 
TH

This is because they're so used to how traditional AVs work, and is, unfortunately, how testing organisations like AV-C see it too. I know Webroot is working with 3rd party testing groups to think differently in their testing methodology, but it isn't going to be easy for them to change as they expect to see results much quicker.

That's true as said by Grayson Milbourne and Joe Jaroch Webroot Bulletin Regarding AV-Comparatives Results
 
TH

On reflection, although Rubenking's initial article got the reaction TH and I made, his review of WSA shows that he does have a general understanding of how the journaling works.
 
Quotes:

To better emulate a real-world scenario I gave all of the infested systems a little more time, rebooting each and letting it sit for an hour or so. Webroot found a number of additional items to clean up and noticeably improved its scores.

It's important to remember that Webroot works differently from almost all of its competition. Except for a very tiny collection of signatures for specific problem viruses, it relies totally on monitoring process behavior and correlating that behavior with data from its immense cloud database. That same behavior monitoring lets it identify which other files are owned by the threat. I'm quite impressed that it can manage a top-notch cleanup job without the baggage of a signature database.

When there's no Internet connection available, Webroot can't communicate with its immense cloud-based intelligence system. It still monitors and notes process behavior, but it can only detect those few specific viruses for which it maintains a local signature.

When you connect again to the Internet, Webroot relays the behavior information it saved to the cloud. If this step reveals that the process is malicious, Webroot uses that same behavior information to roll back the threat's installation.

Thanks for the extra research Tony!  ;)
 
TH