[John Hook]

I’m posting this here because the vast majority of tech support on this site is related to the discovery and resolution of Malware issues. Internet reviews from end-users of this site offer nothing but praise for the excellent technical support obtained here – especially as it relates to indentifying and eliminating malware infections.

All of this said – I’m seeking objective advice and constructive suggestions as it relates to the selection of Anti-Virus/Firewall/Security software suites for Windows operating systems.

Over the past 15+ years, I’ve been using either Norton/Symantec Anti-Virus & Internet Security –OR- McAfee Antivirus / Internet Security Suite. While I have mixed feelings about BOTH of these products – overall, they have both served me and my clients well over the years – providing solid protection on all of the Windows-based PCs where I’ve installed, maintained and supported these products. Over several years, I’ve only experienced 2-5 malware/virus infections which required manual removal while using these products.

Norton/Symantec AV/NIS has detected and blocked SEVERAL Internet-based attacks on my personal PC – allowing me to not only permanently BLOCK the attacker’s IP address, but graphically TRACE this address to the geographic location and specific ISP the offending user was using. Norton NIS also includes email spam protection, parental controls, privacy controls, script blocking and selectively allow users to control which programs have access to the Internet – down to the IP Port level. In addition, Norton provides constant virus signature and program updates automatically using the LiveUpdate feature.

McAfee Internet Security offers similar features to Norton – although I don’t find McAfee blocking as many Internet attacks. McAfee does a good job of indentifying viruses and adware “on-the-fly” allowing the user to remove these threats as their found. McAfee Internet Security Suite has become even more desirable because MOST of my clients use Comcast as their broadband ISP. McAfee is offered for free to Comcast subscribers so the combination of my positive experiences with McAfee coupled with the fact that my clients have free use of this software makes it a desirable choice.

Despite all of these positive attributes, I have issues with BOTH products for various reasons. I’ve found Norton AV/NIS to be a resource HOG in terms of the CPU cycles and memory it consumes. The multiple drivers, services and executables Norton AV/NIS invokes upon startup cause most PCs to take several minutes to boot and become responsive after a user logs in. When installed and configured properly, Norton NIS works well; but if ANYTHING goes wrong (botched update, incomplete startup) or if you attempt to uninstall, reinstall or upgrade Norton NIS – I’ve consistently found that resolving these issues can be extremely difficult and time consuming. Generally, these situations involve having to manually delete program files, alter registry entries, removing application settings in the user profile folders as well as downloading and running product-specific CLEANUP tools from Symantec’s support site. If you’re lucky, after several steps and multiple re-boots – you MIGHT be able to re-install the old product or upgrade to the new version of the product. While Symantec’s support site offers GREAT help in documenting and offering removal help with specific viruses – it does a poor job when offering support for all of the software corruption, uninstall, reinstall and upgrade issues that plague their software.

McAfee doesn’t have install, uninstall and upgrade problems I've experienced with Norton. McAfee is also noticeably faster than Norton. Unfortunately, McAfee doesn’t seem to offer the same level of protection as Norton. Also – McAfee DOES NOT offer bootable media for rescue and boot-up scans. This is a SERIOUS problem since so many of the most destructive malware/viruses infect the boot process, preventing Windows from successfully loading.

All things considered, BOTH of these security suites have done a pretty good job of protecting all of the PCs I’ve used them on over the years. Again, I can only recall a small handful of malware infections that required manual intervention to remove.

Ideally, I would like to find software that would offer the same or better degree of protection without all the problems I’ve consistently experienced with McAfee and Norton. Does something like this exist? Should I stick with what I’m using now?

Any constructive feedback regarding this would be MOST appreciated.

-John

[Advertisements]

Either Nod32 or Kaspersky are far superior to Norton and McAfee. Both Nod and KAV have a "suite" available with things like firewall and other protection toys. They are also comparable in price.

I use Nod32.

[ScHwErV]

Either Nod32 or Kaspersky are far superior to Norton and McAfee. Both Nod and KAV have a "suite" available with things like firewall and other protection toys. They are also comparable in price.

I use Nod32.

[sari]

I will second ScHwErV on the choice of NOD32. I use it on my personal PC, but it is also the choice in the office I support. In the 2+ years I've been using it, it has caught attempted drive-by downloads from websites, phishing attempts, and infected email attachments. I've had no successful attacks in the office at all. It updates quietly multiple times a day, uses very few system resources, and can perform a system scan much more quickly than Norton or McAfee. Also, if you ever need to uninstall it, Add/Remove programs works quickly and easily, without requiring the download of additional tools from the ESET site - I can't say the same for McAfee or Norton.

[John Hook]

ScHwErV & sari,

Thanks for the advice. Looks like I need to check out NOD32! I found the mfg's site http://www.eset.com/ and the pricing looks good - especially for mult-user site licenses. I'm running MS SBS 2003 and it looks like NOD32 provides a server product for my platform.

Questions:

Does NOD32 have an automatic definition/software update feature? If so, are these definitions updated often?

Does NOD32 allow either the creation or is the install CD bootable and capable of scans and/or rescue?

Does NOD32 provide direct integration with MS Office (i.e. automatic scanning of MS Word and Excel files)?

Thanks again!

[sari]

John,

NOD32 runs quite nicely on my SBS2003 server.

To answer your other questions:

NOD updates its definitions multiple times a day, if necessary, and in a very quiet manner. You're simply notified by a balloon in the lower right corner that definitions were updated. It provides program updates as needed, and you have some configuration options as far as automatic reboot, if required, or offering a reboot.

I don't quite understand your second question, as it's not something I've needed to do.

Yes, it integrates with Office apps to provide scanning. It has multiple modules which you can enable (I enable them all), which then monitor internet sites (protects against drive-by downloads), email (scans incoming/outgoing email and attachments), and applications (scans as you open a document). I think there's another that I'm missing, but I'm answering from my phone. Mine also scans documents that are sent via MSN messenger on my home PC. In addition to the automatic scans, it does also give you the option to right-click on a file and scan it.

I don't know if you're running Exchange on your server, but there is also an Exchange version you can get.

One reason I like NOD over Symantec or McAfee is that they do frequent definitions updates. (Kaspersky is better with this too). As an active malware helper, I have the opportunity to submit samples, and Nod is either already detecting it, or adds it very quickly. To me, that's important because of the speed at which malware is mutating.

[sari]

John,

Since I'm now on my computer, I can add to my answer a bit. NOD32 offers the following:

AMON (File system monitor)
DMON (MS Office Document monitor)
EMON (MS Outlook email monitor)
IMON (Internet monitor)

[John Hook]

Sari,

Thanks for all the helpful info. Yes, I DO use Exchange as well as IIS and Sharepoint services on my SBS 2003 server. I also run MS SQL Server which is my DB Server for the Lytec Medical 2006 software my client uses. The Exchange version is something I'd be very interested in.

My second question, I'm referring to Bootable CD or DVD media with run-time operating system and AV software that can scan, detect and hopefully repair viruses that render Windows "un-bootable" or remove viruses designed to prevent detection and/or removal while Windows is running. Norton/Symantec's AV/NIS products typically have install CDs that double as this type of "bootable" emergency repair/recovery discs. Another product, avast! BART CD offers this bootable AV funtionality:

http://www.avast.com...st_bart_cd.html

These viruses tend to be more of a threat to XP rather than Server 2003. Since I run several networked and standalone XP systems, it would be nice to have a bootable scan/detect/repair feature.

Knowing the high level of malware expertise on this site - I would welcome and encourge feedback from others about Bootable AV solutions or any other advice about NOD32.

Thanks again for all the helpful feedback. Any av/security suite the offers the same or better protection than McAfee or Norton WITHOUT all of the performance tradeoffs and messy install/uninstall/upgrade issues would be a welcomed change for me! The SBS Server-specific features are also something I've been looking for. I will definately download a trial version of NOD32 and check it out.

- John