NWA-PCUG Newsletter Article, February 2009
Norton Internet Security 2010
By Ash Nallawalla, Reviews Editor,
Melbourne PCUG, Australia
http://www.melbpc.org.au
ash (at) melbpc.org.au (click to email author)

This article has been obtained from APCUG with the author’s permission for publication by APCUG member groups; all other uses require the permission of the author (see e-mail address above).

It’s about that time of the year when we have to update our antivirus (AV) software and so I installed Norton Internet Security (NIS) 2010 on my Windows 7 desktop. My previous AV package was Norton 360, which includes much of NIS 2009.

There is a whole virus-making industry out there on the Dark Side, which constantly unleashes new malware and makes it more sophisticated all the time. These days, the infections try not to damage your files. You may not even be aware of the threat, because your PC is more valuable as a remotely controlled zombie. Your PC could be used to send a moderate amount of spam, or be used as a proxy site to perform some shady actions, or to propagate malware.

Features
NIS 2010 requires a minimum of Windows XP 32-bit with SP2 or later. In Windows Vista and Windows 7, both 32-bit and 64-bit versions are supported.

As is to be expected with an Internet security product, NIS 2010 provides the following features:

* Blocks viruses, spyware, Trojans, worms, bots and rootkits
* Two-way firewall
* Email protection
* Parental controls
* Home and public network security
* Identity protection
* PC tune-ups


NIS does not perform a backup/restore of important files as is done by Norton 360 Version 3.0 but I didn’t miss that feature as I use another program for backups. It does a little more in the tuneup department, so I felt a little better off.

Technology
A staple ingredient of AV software has been a look-up table of “signatures” – sequential bits of programming code whose presence on your PC means that you are infected. A full PC scan compares all your files with these signatures and takes action as you wish, e.g. clean, quarantine, or delete the infection.

Over the years, AV vendors also introduced heuristic scanning, which examines your files for signs of code that could do the wrong thing. For example, if your Word document is infected with malware that includes an instruction to format your disks, then this is considered abnormal and flagged as a risk. You can imagine that the poor AV software has a lot of checking to do and could slow down your work if the list of signatures keeps rising.

Mutating malware becomes harder to detect, as the signatures keep changing, so all unknown files need to be checked. Symantec now uses a family of techniques called Quorum to speed up this scanning. Quorum uses reputation to assess each new file it finds, based on the Norton Insight Network community of other people who use the same software. For example, if you downloaded a PDF file from a site that is flagged as risky by Norton SafeWeb, then it will be scanned. If the filename and signature are known to it, say, a Microsoft product, then it will skip it by default. If many people run some new application from a new company, in time, this anonymised usage data will get to Symantec (with your permission) and eventually it will get to the safe list.

Norton Insight Network

Dashboard

The Norton Toolbar helps protect your web surfing

In Use
The single-user version came on a car-shaped USB drive and installed easily. It disabled Windows Defender and got to work, downloading updates immediately. I don’t surf at dubious sites so I don’t expect to find viruses every other day, but when I inserted a little-used USB drive, it found a virus in its autorun file.

Virus found!
One of the benefits of using Norton security products is that your web browser is enhanced to show a green tick, red cross or a question mark when you perform a search. This is part of Norton SafeWeb, which has a collection of known safe sites and known harmful sites. The rest are yet unknown to SafeWeb. I was looking for a file and clicked a likely result, but I remembered that the website was classified as unsafe, and then wondered why I wasn’t seeing the ticks and crosses.

Upon reading the Norton support forum (http://community.norton.com) I found out that the Skype add-on for Firefox was the problem. I removed the add-on and the SafeWeb markers returned.

Before: Notice no Norton SafeWeb ticks after each result.

A safe download

After: Remove Skype add-on for Firefox: problem fixed

Availability
NIS 2010 is available from most software retail outlets for $100 or less.

For more information about Quorum, see http://tinyurl.com/quorum2. For a study of similar products by AV-Comparatives, see http://tinyurl.com/na5k5x.

Click here to return to top



==================================================================