Sunday, August 26, 2007

TOP 5 Antivirus

Kaspersky Anti-Virus 6.0
This effective but expensive program has solid malware detection and the fastest outbreak-response time among currently tested competitors.

Our Best Buy stand-alone antivirus program, Kaspersky Anti-Virus 6, shines for its top-notch malware detection and disinfection rates. It boasts a 96 percent detection rate, and cleaned 86 percent of all items in our disinfection tests. It is also the fastest at delivering new signatures out of the eight tested programs, with an average response time of 0 to 2 hours.

You'll pay for this stellar performance, however. At $50 for the downloaded product, it was the most expensive program we tested in our antivirus roundup, though renewals drop to $35 per year. Also, its proactive protection was only middling, catching just about half of 200 new malware samples when tested using a one-month-old signature database.

Kaspersky Anti-Virus 6 has a polished interface that makes it easy to schedule scans. Clearly labeled, one-click drill-downs make finding and setting up advanced features a breeze.

For e-mail and news traffic, the program scans incoming and outgoing data over the POP3, SMTP, IMAP, and NNTP protocols. It monitors HTTP traffic for Web-borne threats as well. However, it doesn't set up a default scheduled scan--you'll need to set one up yourself.

Built-in antiphishing protection can block scam e-mail, and a "proactive defense" module looks for the hidden processes and Registry changes that can signal malware hidden with a rootkit.
If you buy this program, do so online--the download is $10 cheaper than the retail box. If you want the Vista-compatible flavor, you'll have to download the program in any case. Just be sure to download the right version; it's easy to click the wrong link among the many others on the download page.

You get free phone and e-mail support during business hours from Monday through Friday, though the phone number isn't toll-free. The company says that it will answer support calls placed after hours on weekdays and throughout the weekend, on what it calls a "best-effort" basis.
Symantec Norton AntiVirus 2007
Symantec's solid program wins top marks for antivirus detection and cleanup, but its renewal and support costs are high.

Symantec Norton AntiVirus 2007 took second place in our "Virus Stoppers" roundup of eight stand-alone antivirus programs. Its overall virus detection rate of 96 percent places it firmly in the upper echelon, and like our other top-rated products, it sports an attractive and easy-to-use interface.

It was the slowest to respond to virus outbreaks, however, taking an average of 10 to 12 hours to deliver new signatures. And its proactive protection is only average--it caught about half of the unknown threats in our test using one-month-old signatures.

Norton AntiVirus costs $40 initially, but Symantec offers only a paltry $1 discount for yearly renewals, making it one of the more expensive antivirus options in the long term. Tech support is likewise costly: The advertised free phone support applies only to installation problems and known bugs; other types of calls will cost you $10 each.

Norton performed well in our disinfection tests, second only to Kaspersky in our antivirus roundup. It cleaned up 18 out of 22 possible items, missing only one of the two changes to the Hosts network settings file and three less-important Registry items.

Symantec has incorporated the new SONAR behavioral analysis technology for proactive protection. The program scans both e-mail and Web traffic, covering the POP3, SMTP, and HTTP protocols. And it ties into the MSN, Yahoo, and AOL instant messaging programs (though it protects only MSN by default).

During our design tests on Windows Vista Ultimate, the program turned off the built-in Windows Defender antispyware utility without notice. This is not because the utility conflicts, according to the company, but because Symantec feels "Windows Defender offers no value beyond what Norton offers." BitDefender Antivirus 10 was the only other program we tested that disables Defender when it installs.

Symantec Norton AntiVirus 2007 was also the only tested program that triggered multiple UAC (User Account Control) alerts when we changed settings, which could easily annoy power users who might want to customize the app.
BitDefender Antivirus 10
BitDefender has excellent malware detection and a good price, but it adds a noticeable (though not show-stopping) system slowdown.

BitDefender Antivirus 10 nearly took top honors in "Virus Stoppers," our eight-program antivirus roundup. It did an excellent job of detecting malware, with a 96 percent catch rate. It also ranked second in our proactive detection tests (behind Eset's NOD32) using one-month-old signature files, nabbing 61 percent of new malware samples. And at $30, with a $22 renewal fee, it's one of the least-expensive programs we tested.

The program was badly hamstrung by serious slowdowns in our WorldBench 6 Beta 2 application performance tests on Windows Vista Ultimate, however. One Firefox test, for example, which loads a large number of different Web pages, took three times longer with BitDefender than with any other program we tested. The slowdown wasn't debilitating, but it was noticeable. The company says the problem is a known bug in the Vista version that will be fixed in a future program update.

Though it excelled at malware detection, BitDefender was less adept at disinfection. It successfully cleaned just 13 out of 22 items, missing one malware file and both changes to the network settings Hosts file.

BitDefender also had the highest false-positive rate, incorrectly labeling 14 harmless files (out of 20,000) as malware.
On the plus side, BitDefender has a well-designed interface. A slider bar in the main window provides an easy way to modify levels of security protection, and clearly marked icons let you launch full scans and set up custom scans. BitDefender was also the only product to offer free 24/7 phone support, with easy-to-find phone numbers and support e-mail addresses listed in the "Help" section of the application.

By default, the program runs a full-system scan daily. It scans e-mail traffic on the POP3 and SMTP protocols and integrates nicely with Microsoft Outlook, Outlook Express, and Windows Mail (on Vista) for antispam filtering. BitDefender has a basic level of instant messaging protection, but unfortunately it doesn't scan HTTP traffic by default to identify Web-borne threats--you'll need to turn on that capability yourself.

A useful "privacy guard" feature detects when personal information--such as a credit card or Social Security number--is being stolen from a computer, without your having to first tell it what those numbers are. BitDefender was one of the only two programs we tested that automatically disabled Vista's built-in Windows Defender antispyware utility, however. Symantec Norton AntiVirus 2007 was the other.
Eset NOD32
NOD32 has the best proactive protection by far, but its overall malware detection is second-tier, and it has an overly technical interface.

When it comes to proactive protection, Eset's NOD32 was the hands-down winner in "Virus Stoppers," our eight-program antivirus roundup. In our tests, it caught 79 percent of unknown malware samples when using one-month-old signature files. The next-closest program, BitDefender Antivirus 10, came in with a distant 61 percent.

NOD32's overall malware detection rate wasn't stellar, however. When pitted against AV-Test.org's nearly 900,000-strong "zoo" of Trojans, viruses, and other malware, NOD32 caught only 90 percent, compared to the 96 percent rate of top performers Kaspersky Anti-Virus 6, Symantec Norton AntiVirus 2007, and BitDefender Antivirus 10. It fared surprisingly poorly with 32-bit Windows viruses (approximately 1 in 11 samples in the zoo), catching only 73 percent.

In disinfection tests, NOD32 cleaned up all malware files but missed resulting changes to the Hosts network settings file and most of the less-important Registry changes, for a disappointing 55 percent success rate.

The program installed without a hitch, and the default settings were almost ideal for the average customer. One annoyance: NOD32 doesn't enable the full-system scan by default; you have to schedule it yourself. And when you set that up or want to change other settings, you might be turned off by an overly technical interface: For instance, you'll need to open up the 'DMON' interface module to figure out that it's responsible for scanning Microsoft Office documents. If you do need help, the program offers no guideposts for finding phone or e-mail support; you must go to the company's Web site.

The program ties into Outlook and Outlook Express for e-mail scanning, but doesn't directly integrate with any IM applications for scanning sent links or files. Plus, it offers integrated virus, spyware, and adware protection, where some other programs require two separate scans, one for antivirus and another for antispyware. The multithreat engine can also detect malware-hiding rootkits.
Panda Antivirus 2007
This well-priced option provides good proactive protection, average overall malware detection, and a poor disinfection rate.

Panda Antivirus 2007's middle-of-the-road malware detection results, inadequate default settings, and poor disinfection performance offset its useful features and attractive pricing to produce an unimpressive fifth-place ranking in "Virus Stoppers," our roundup of eight stand-alone antivirus programs.

The app caught 90 percent of AV-Test.org's nearly 900,000-strong collection of malware samples, a detection rate that was dragged down by a relatively poor showing at catching Trojan horses (87 percent) and back doors (86 percent), two increasingly common types of malware. By comparison, top programs caught 96 percent. Panda ranked third in our tests for proactive detection, however, catching 56 percent of new samples with one-month-old signatures.

Unfortunately, several important features are turned off by default. You'll need to enable e-mail scanning yourself in a complicated process that sends you to the Windows Control Panel. Protection against "potentially dangerous files," a euphemism for the adware and other junk normally caught by antispyware software, is also turned off, and you'll need to schedule your own full-system scan.

Once you turn on these features, Panda Antivirus scans will cover a good range of e-mail and news protocols--POP3, SMTP, IMAP4, NNTP--along with Web traffic. It flags suspected phishing e-mail sent over POP3 and SMTP, and integrates with Yahoo, MSN, and AOL IM applications.

Panda Antivirus 2007 scored poorly in disinfection tests. It missed one existing infection entirely, and failed to clean up another's changes to the Hosts and Registry files. Including less-important Registry changes, it scrubbed up just 41 percent of the infections. And after we uninstalled it, Panda left behind a stray .dll file that some other antivirus programs then flagged as potentially suspicious.

At $30 for two PCs (there is no single-license rate), Panda Antivirus 2007 is among the most affordable programs we tested, but unlike most apps, it offers no renewal discount. And mark your calendar when you make tech-support calls: The company offers free telephone support only for the first 30 days; after that a call costs $20.

Friday, April 13, 2007

Antispyware Reviews


Webroot Spy Sweeper 5.0
Antispyware program combines solid performance, features, and ease of use.

• Price when rated: $30
• Renewal price when rated: $30
• PCW rating: 87 Very Good
• Performance rating: Very Good
• Design rating: Superior
• Features rating: Superior

A beta version of Webroot's Spy Sweeper 5.0 earned a Best Buy distinction in our October 2006 issue's "Spyware Specialists" story. It produced the top score in performance tests and offers protection against rootkits and phishing Web sites.

In tests performed by AV-Test.org, Spy Sweeper ranked first among the five products tested for "Spyware Specialists." It detected 90 percent of actively running adware and spyware samples and four of nine active rootkits. In disinfection tests, it cleaned up 40 percent of adware and 65 percent of spyware. In real-time detection tests, Spy Sweeper detected all additions to HKCU and HKLM Run keys (Registry keys targeted by many malware threats) and to Windows Startup and the Hosts file. It also detected all changes to the Hosts file and Internet Explorer Home and Search pages. Spy Sweeper offers superior features including real-time analysis of phishing Web sites and full startup, scheduled, and custom scanning options. It also includes conveniences like CPU usage settings, which let you decide whether to do a fast system scan that takes priority over other work or a slower scan that's less intrusive. Another nice touch: Spy Sweeper adds itself to the Windows Explorer contextual menu for quick scanning of files and folders.

We do have one reservation: In the version 5.0 beta, Webroot removed Spy Sweeper's previous ability to set a system restore point, relying instead on the restorative features of its Quarantine, where you decide whether or not to remove questionable files found in scan results.

By Narasu Rebbapragada




PC Tools Spyware Doctor 3.8
Antispyware program combines solid performance, features, and ease of use.

• Price when rated: $30
• Renewal price when rated: $30
• PCW rating: 85 Very Good
• Performance rating: Very Good
• Design rating: Very Good
• Features rating: Superior

PC Tools' Spyware Doctor 3.8 offers solid protection against adware, spyware, and rootkits in an easy-to-use and feature-rich interface. The company releases frequent product upgrades, which come with the $30 annual subscription fee. As a result, we performance-tested version 3.8 of the product and then user-tested version 4.0.

In tests performed by AV-Test.org, Spyware Doctor ranked second overall among the five antispyware products tested for the "Spyware Specialists" story. Version 3.8 detected 90 percent of adware and spyware samples and disinfected 50 percent of adware-infected files and Registry entries (a first-place ranking).

As with all antispyware products, its adware disinfection results are partly a reflection of policy decisions on what is adware and what isn't. For example, PC Tools no longer classifies as adware the free version of HotBar, an ad-supported Internet Explorer toolbar, and won't disinfect it, as our tests confirmed. On the flip side, PC Tools has reclassified WebSearch as adware; although Spyware Doctor 3.8 didn't detect it, the company says version 4.0 will. Spyware Doctor disinfected 65 percent of spyware-infected files and Registry entries (a first-place ranking shared with the beta version of Webroot Spy Sweeper 5.0) and was the only tested product to detect 100 percent of active rootkits.

Spyware Doctor 4.0 was easy to install and use. I liked its scan results interface, which cleanly categorizes possible infections with brightly colored bars and detailed levels of threat classification. But the results themselves were a bit alarmist. In my informal user tests on a PC, Spyware Doctor counted 287 "infections" (going with its doctor theme) but categorized the vast majority as low-level advertising and tracking cookies. While it took only a few seconds to realize that most infections weren't dangerous, the growing triple digit count during the scan did quicken my pulse. Spyware Doctor also identified as present a high-risk keylogger and an IM worm that three other antispyware programs did not. While I removed those files without consequence, I couldn't be certain whether they were false positives or real threats that the other programs could not detect. I asked PC Tools to comment on these particular files, but didn't receive a response in time for publication.

Spyware Doctor offers some useful additional features. It lets you set a system restore point, in case of accidental deletion of important files; it protects against your visiting known phishing sites (sites that fraudulently solicit financial and personal data); and it supports scanning of instant-messaging clients. Currently, PC Tools supports MSN Messenger and Live Messenger but plans to add support soon for AIM, Skype (file and text transfers only), Trillian, and Yahoo.

By Narasu Rebbapragada


Sunbelt Software CounterSpy 2.0 Beta
Well-designed antispyware program detects threats better than it disinfects them.

• Price when rated: $26 (download $20)
• Renewal price when rated: $10
• PCW rating: 76 Good
• Performance rating: Good
• Design rating: Very Good
• Features rating: Fair
The beta version of Sunbelt Software's CounterSpy 2.0 didn't fare as well as we had expected in our October 2006 issue's roundup. This perennial top contender performed weakly in disinfection tests, but it offers solid real-time protection, a well-designed interface, and useful privacy utilities.

In performance tests conducted by AV-Test.org, CounterSpy ranked third among the five products tested for our "Spyware Specialists" story. CounterSpy's behavior-based detection capabilities proved strong, flagging all additions to HKCU and HKLM Run keys (Registry keys targeted by many malware threats) and Windows Startup. CounterSpy detected all changes to the Hosts file and Internet Explorer Home and Search pages as well.

But in disinfection tests, CounterSpy cleaned up only 35 percent of adware and spyware samples. Sunbelt Software says that CounterSpy's low score is due to the beta status of the product and to AV-Test's sample set, which Sunbelt does not consider representative of today's most important threats. In response, AV-Test says that it downloaded all tested spyware and adware in May or June 2006 from live sites on the Internet.

While CounterSpy lacks a startup scan and antiphishing tools, it offers system restore features and four privacy-centric utilities (which we did not test for our antispyware roundup): MyPC Explorer lets you view and modify Windows and browser system settings; My PC Checkup performs a check of your overall system security; History Cleaner purges Internet Explorer surfing trails; and Secure File Eraser makes sure that nobody can resurrect your deleted documents.
By Narasu Rebbapragada


Lavasoft Ad-Aware SE Personal 1.06
This free antispyware program with a solid scanning engine lacks real-time protection.

• Price when rated: Free

• Renewal price when rated: Free
• PCW rating: 64 Fair
• Performance rating: Fair
• Design rating: Good
• Features rating: Poor

Lavasoft's free Ad-Aware Personal 1.06 does a good job of protecting you against adware and spyware that have already made the trip to your PC, but it lacks the preventative protection features that are available only in Lavasoft's paid products.
In performance tests conducted by AV-Test.org, Ad-Aware ranked fourth among the five products tested for our "Spyware Specialists" roundup despite solid detection and disinfection scores. This free app detected 85 percent of active adware and spyware samples thrown at it. It also disinfected 45 percent of adware and 60 percent of spyware samples. Ad-Aware did the best job of detecting inactive adware and spyware samples--a testament to Lavasoft's malware signature database.

However, Ad-Aware Personal lacks both rootkit protection and, more important, the Ad-Watch real-time protection that is available in Lavasoft's $27 Ad-Aware SE Plus. (Real-time protection helps prevent threats from landing on your system in the first place.)
Several other options available only in Ad-Aware SE Plus are marked with grayed Xs in the free version's otherwise nicely designed interface. These features include a startup scan, scheduling of scans, and automatic software updates. Without having tested SE Plus, we can't judge how effective these enhancements are.

Ad-Aware SE Personal, which lacks even e-mail tech support, is by definition a crippled program since Lavasoft wants you to upgrade to the paid product. As a result, we recommend it as good second layer of defense against adware and spyware--but your primary application should have real-time protection.
By Narasu Rebbapragada

Safer Networking Spybot-Search & Destroy 1.4
This free antispyware program has lots of settings, but it doesn't perform that well.

• Price when rated: Free
• Renewal price when rated: Free
• PCW rating: 63 Fair
• Performance rating: Poor
• Design rating: Good
• Features rating: Fair

Safer Networking's Spybot-Search & Destroy was saving the world from spyware before most people even knew what spyware was. Built in the proverbial basement, Spybot version 1.4 has on-demand scanning, real-time prevention, and detailed settings--all for free (donations accepted). The problem is that, these days, Spybot doesn't perform as well as other programs.
In tests performed by AV-Test.org for the "Spyware Specialists" story, Spybot performed worst of the five products tested. While detecting a solid 80 percent actively running adware and spyware, it detected only 2 percent of inactive threats. It disinfected a median 45 percent of adware but a far-below-average 20 percent of spyware. It also offers no protection against actively running rootkits. On the other hand, Spybot's Tea Timer real-time protection performed well in behavior-based detection tests. Spybot also successfully detected additions to HKCU and HKLM Run keys (Registry keys targeted by many malware threats) and changes to Internet Explorer Search and Home pages; however, it did not detect changes to the global startup folder.

Spybot's interface is deep with options, but its settings window buries within it a dizzying number of check-box options for file recovery, scan speed optimization, and startup tasks. Techie types who want minute control over individual line items might like these options. And avid readers with tech savvy may enjoy Spybot's scan results: They are full of honest, tongue-in-cheek, but somewhat technical commentary about potential threats. ("I won't call a saved IP in combination with a log of visited Web pages anonymous!" says the developer.) The dialog boxes also give you information about recent changes in adware policies. Unfortunately for those that need it, however, Spybot stops short of the bonehead-simple "Get rid of this" type of advice the paid applications give you.

Spybot also falls short where all free security programs do, and that's in free telephone tech support. Spybot does provide e-mail tech support--that's better than the free version of Ad-Aware, which doesn't offer any support. I also experienced an irritating interface glitch that obscured the buttons on a dialog box asking me (presumably) to allow or deny a change to a Registry file.

Despite the bugs, some PC users will continue to use Spybot out of thrift or sheer loyalty; but other programs provide better protection against current threats.

By Narasu Rebbapragada
Information from www.pcworld.com