Product Reviews

There's intense competition in the anti-virus market, which is good news for users, as products are dropping in price while expanding on features. Even better, virus signature support is literally being given away. After letting the competition get their first strikes in, Symantec has now joined the fray with Norton AntiVirus Deluxe 4 (NAV).

While McAfee's VirusScan (reviewed issue 34, p166) was impressive, many similar features are available in NAV. It handles real-time scanning by using a virtual device driver (VxD) called Auto-Protect, which is loaded at start-up and accessed from the System Tray. This keeps an eye on all files by scanning them before they're activated. If you start a program, the executable will be checked first and only allowed to run if Auto-Protect gives the all clear. This applies to all files, even if they're just opened, copied or moved. Newly created files will also be checked, so Internet downloads will receive the same treatment.

To protect against new or unknown viruses, deeper scanning is available with Symantec's Bloodhound detection technology. This is a heuristic scanning technique which looks for suspicious behaviour that may indicate a virus is at work. Inoculation provides even greater protection by recording a checksum of a file's contents and verifying it whenever it's accessed. If the results don't match, then the file's contents must have changed - perhaps as a result of viral activity. Be prepared for false alarms though, as a simple product upgrade will set Auto-Protect to red alert.

In the event of a positive detection, there are a number of ways in which you can respond. The infected file can be repaired, deleted or you can have Auto-Protect prompt you for a course of action. Another option that may seem a little excessive is to have your PC switch itself off when Auto-Protect senses danger. In fact, there are so many choices it would be worthwhile taking time to familiarise yourself with them. Symantec recommends assessing your risk level to determine the appropriate level of protection and provides copious on-line help to ensure you configure Auto-Protect correctly.

Floppy disks are included in the scanning

ADVERTISEMENT

process and Auto-Protect takes no chances by scanning the drive at system shutdown. This stops boot sector viruses in their tracks, as when the PC is next switched on a potentially infected disk won't still be lurking inside. However, when it came to testing, I wasn't so impressed by Norton's method of dealing with infected floppy disks. An ugly DOS screen presents you with an option to either run repairs or ignore the problem and continue. Should you choose the latter, Norton will grant full access to the floppy, which is a bad idea - an infected floppy should never be used until cleaned.

Norton AntiVirus is the main program that provides on-demand scanning. Using a collection of bugs that included macro viruses, file viruses, polymorphics and multipartites, all 50 were correctly identified, although it was unable to repair 15 of them. Some of the nastier viruses cause so much damage to file contents that it can be a waste of time trying to fix them - it's far more sensible to replace them with a clean copy from your latest backup. I had no problems with macro viruses; Nuclear and Concept were allowed to run riot over Word documents on the test PC and AntiVirus removed them all, leaving genuine macros intact. Network support is better than most too, as not only can AntiVirus scan mapped drives, but it also has an option to send alerts to Symantec's NetWare and Windows NT Server versions.

If you're wondering why this version of NAV bears a Deluxe label, it's because a few extra tools are bundled that have apparently escaped from Norton Utilities. CrashGuard runs in the background and attempts to restart tasks that have stopped responding. Secret Stuff offers data encryption, and extra Internet security is provided by Safe On The Web. This stops dubious ActiveX and Java applets from running, checks and advises on Web browser security settings, and allows files to be designated as 'untouchable' so that only the program that created them has access.

Symantec follows the lead taken by Cheyenne's Anti-Virus software (reviewed issue 35, p185) and every month offers free lifetime signature updates on its FTP or BBS sites. The whole process has been automated by LiveUpdate, which links directly to the download site, pulls in the new file and updates AntiVirus. A program scheduler is included which can be used to run LiveUpdate regularly; a direct Internet connection isn't required as LiveUpdate can be set to call up Symantec's UK FTP site, complete the download and drop the line afterwards.

Such healthy competition from other software vendors clearly brings only benefits, as Norton's AntiVirus is packed with quality virus detection and disinfection tools. The free lifetime signature upgrades also make for great value for money.