Norton AntiVirus 2008 with Spyware

The good: Norton AntiVirus 2008 provides solid antivirus protection.

The bad: Norton AntiVirus 2008 is roughly six times the size of most competing antivirus applications; doesn't offer three-user license; doesn't support Firefox; doesn't work with recent Yahoo and AOL IM applications (only old versions); offers fee-based services under the guise of technical support.

The bottom line: Norton AntiVirus 2008 didn't wow us this year. While the protection is solid, the user experience could be much, much better, and the product itself could be more streamlined. Also we can do without the addition of paid services in the technical support section.

Editors' note: On March 5, 2008, CNET revised its antispyware review ratings to emphasize a product's ability to remove spyware. The new ratings are based on the following formula: Installation (20 percent), Features (20 percent), Performance (50 percent), and Support (10 percent). In most cases a product's rating went down, expanding the range between highest and lowest rated.

Having improved a lot last year in Symantec's flagship antivirus product, it makes sense we'd see more modest enhancements for this year's Norton AntiVirus 2008. While Norton AntiVirus 2008's antivirus test results compare favorably to our Editors' Choice winner Kaspersky Anti-Virus 7, it's the user experience that suffers in this release. The final size, a hefty 300MB, makes us wonder what's taking up all that extra space--Norton AntiVirus 2008 is roughly six times the file size as Kaspersky. Unlike Kaspersky, Norton AntiVirus 2008 is only available in a single-user license edition. Unlike Kaspersky, Symantec provides Norton users with little explanation of its features or settings, either in the configuration settings or on its technical support section. Also we don't like Norton's dependency on Internet Explorer to explain Help items or services provided by Symantec (windows pop up in IE even when Firefox is your default browser), or that fee-based services have once again crept into the technical support section. All of these things distract the user and weigh the product down in our minds. Your computer is safe with Norton AntiVirus, it's just, do you really need all that extra stuff installed as well? For a look inside Norton, see our Norton AntiVirus 2008 slide show.

Setup
Norton AntiVirus costs $39.99 for a single license. By comparison, Panda Antivirus offers its three-user license for the same price. While Kaspersky is slightly more expensive, selling its single-user license for $49.95, it offers a three-user license for just $10 more. There are no three-user licenses available for Norton AntiVirus 2008, so, if you have two more computers in your home network, you'll have to pay $40 for each computer.

Norton AntiVirus 2008 runs on Windows XP and Windows Vista, but not Windows 2000 or any earlier version of Windows. Norton AntiVirus 2008 requires at least 256MB of RAM and a whopping 300MB hard drive (consuming roughly six times the space of most of its 2008 competitors). Symantec does offer a full function 15-day trail of Norton AntiVirus 2008.

LiveUpdate, which used to be a separate process, is now integrated into Norton AntiVirus 2008--and about time. Once the product is installed and you're asked to update, everything--program files and signature files--arrive on your desktop together, making the experience smoother and easier. Symantec says this year's LiveUpdate packets are more compressed.

Should you decide to uninstall Norton AntiVirus 2008, there is an uninstall option on the All Programs listing. This, we discovered after contacting Symantec, does little more than what Windows Add/Remove will do for you. In other words, it won't necessarily remove all traces of Norton AntiVirus 2008 from your PC. To do so, you need to use the Norton Removal Tool. According to Symantec, this Norton Removal Tool "uninstalls all Norton 2008/2007/2006/2005/2004/2003 products and Norton 360 from your computer." The difference, we were told, is that "the removal tool will remove shared components, like LiveUpdate, even if other Norton products that depend on the shared component are installed."

Interface
If first impressions are everything, Norton AntiVirus 2008 loses us at "Hello." The new interface design is dark and garish, almost a perverse joke on those seeking reassuring security for their desktop. The use of ominous thick black borders and orange graphics suggests Halloween, a look that could get old by March. Unlike Kaspersky and other antivirus applications, you can't change the look and feel of Norton AntiVirus 2008. The unfriendly look and feel is, perhaps, a deeper metaphor for the overall lack of the configuration settings within Norton AntiVirus 2008.

Symantec might want to rethink the thick black and orange border next year.

Our central problem is that Norton offers some wonderful features, but we have no way of tweaking any of them. Drilling down to the configuration settings we see "Turn on Suspicious Activity Monitoring" or "Turn on Bloodhound heuristics"--but do we really need these features? Symantec provides us with very little additional information (for example, the built-in Help file says only "Turn on Bloodhound heuristics," not what it does), continuing with a practice adopted long ago by Symantec of making decisions for the user rather than presenting the user with options. Then there's my favorite "Turn on Advanced Mode" under the Suspicious Activity Monitor--it's not on by default, so should we turn it on? (Apparently the only difference between regular and Advance Mode is that the Suspicious Activity Monitor will log it in regular and alert you in Advanced mode). Again, you have to accept that Norton has your best interests in mind.

Kaspersky also uses similar enable/disable options--that's really not at issue here. The difference between the products is that Kaspersky offers a thorough 323 page user's manual explaining your choices where Norton does not. Unless you are fluent in Symantec speak, configuration options such as Bloodhound, Browser Defender, and SONAR are meaningless. Nor can you truly customize these in any meaningful way, with few options to provide unique rules.

Symantec limits (if not removes) a user's ability to customize and tweak individual settings throughout Norton AntiVirus 2008; for example, there's no quick way to set Norton to only scan new or recently modified files. Head-to-head, Kaspersky gives users more enable/disable options.

We're also not keen on Symantec's use of a large yellow block in the task tray that says Norton all the time. While other vendors have discrete icons, even icons that rotate or blink, we found the constant advertisement in the lower-right-hand corner visually distracting and unnecessary. Norton AntiVirus 2008's popup alerts were no bigger or smaller than its competitors.

Features
While there are few new features within Norton AntiVirus 2008, most of Symantec's new protection features are again reserved for the Norton Internet Security 2008 release.

One significant new feature shared across both products is network monitoring. Following advances made by Trend Micro and others in past years, Norton AntiVirus 2008 now creates one licensed user to be the local network security administrator, allowing that user to monitor the security of other computers on the network, and, if necessary, run scans and updates on those other computers. The caveat here is that the other computers must also be running Norton AntiVirus 2008 or Norton Internet Security 2008.

Also new is Browser Defender. Like SONAR, a behavior-monitoring and blocking feature acquired last year from a company called Whole Security, Browser Defender, formerly known as Canary, is a proactive heuristic layer that specifically identifies signatures of known Internet Explorer browser vulnerabilities and will block any Symantec-known exploits. The idea behind Browser Defender is that vulnerable browsers are the first point of entry for many Web threats known as "drive by" downloads, and that IE has a number of outstanding public vulnerabilities. Problem is that Browser Defender doesn't work for other browsers. Firefox users are still out in the cold, despite occupying up to 20 percent of the browser market. In our informal tests, using only Internet Explorer, one porn site in particular we use for testing was flagged by other browser defenders as containing several iframe referrers, but Norton did not so much as peep about the Web Attacker content on that site. While this is not an exhaustive test, it does suggest that free browser scanners might be used in addition to Norton. For Firefox (and even Internet Explorer) users, we recommend the free download of LinkScanner Lite as a second option on malicious Web sites.

Another feature that's important today keeps malware sent via IM from infecting your PC. Norton AntiVirus 2008 does that, but only if you have Microsoft (6.0 or higher) or Trillian (3.1 or higher). If you have older versions of the most popular IMs, AOL (4.7 to 5.9), Yahoo (5.x and 6.x), you're golden, but both of these products have updated significantly in recent months. To test this, we installed Yahoo Instant Messenger 8.1 and sure enough, Norton AntiVirus 2008 reported that we did not have any instant messengers installed. Given that both AOL and Yahoo have suffered large-scale attacks in recent months, it's odd that Norton doesn't yet support the latest versions of these.

What's missing? Symantec beta tested another product this summer, however, Norton Anti-Bot is not available in any of the traditional 2008 Norton security products. At $29.99, Norton Anti-Bot, which simply provides signature and heuristic protection against botnets taking residence on your desktop computer, is almost the price of Norton AntiVirus 2008, and, as such, simply is not worth it is a standalone product. We look forward to Symantec including its anti-bot technology in next year's release of Norton AntiVirus.

Performance
Norton AntiVirus 2008 scored well in both our CNET Labs' Windows XP performance tests and in third-party, independent antivirus tests using live viruses. On our iTunes test, Norton AntiVirus 2008 was in the middle of the pack, just 3 seconds above our test system. On our Microsoft Office test, Norton AntiVirus 2008 came in near the middle at 1,459 seconds. For scanning a single folder with files, Norton AntiVirus 2008 came in near the middle with 173 seconds. And in boot speed, Norton AntiVirus 2008 came in last place, with a sluggish 40 seconds. To find out how we test, see CNET Labs' How we test: software: antivirus page.

In terms of protecting your PC, we cite results from two leading independent antivirus testing organizations. In the latest test results from AV-Comparatives.org, for on-demand scans the previous version Norton AntiVirus 2007 earned an Advanced + (the highest) rating, catching 98 percent of all malware tested; and for the Retrospective/Proactive test, the previous version of Norton AntiVirus 2007 earned an Advanced (second-highest) rating, detecting almost half the backdoors, Trojans, and other malware sampled. Norton AntiVirus 2007 received a Standard rating from CheckVir.com, meaning only the virus searching capability was examined.

CNET Labs will be testing the antispyware in Norton AntiVirus 2008 separately, in October. Our suspicion is that Norton AntiVirus 2008 will match last year's results and finish fairly high in our ranking.

Support
While Symantec continues to improve its technical support experience, Norton AntiVirus 2008 reverts to its old ways. Symantec provides a fairly light 13-page user's manual that mostly addresses how to install the product, not use it. Like last year, Symantec's support options include an automatic diagnostic tool for the program. It's worth noting that one of the comments it made is: "Your computer runs slowly after installing Norton AntiVirus 2008," which leads us to believe that many people experience this condition. There's also free chat, free e-mail, and telephone service.

After an absence of one or two years, advertising once again creeps back into the Symantec's technical support section in the guise of "Expert Services" and "PC Tune Up." Both are paid consulting services that, if you're not careful, could cost you up to $69.95 (that's a flat fee) per call. In the PC Tune Up scenario, you call up, are charged, and a Symantec technician remotely accesses your PC to resolve any problems you might be having at that time. Some might find that comforting, but at $70 you can probably find free help by doing a Google search for your error message or problem, since Symantec doesn't yet maintain a user's forum.

Conclusion
Although the antivirus protection is similar between Norton AntiVirus and Karspersky, we give the nod to Kaspersky again this year in part because of its superior user experience. Symantec, despite its efforts, still feels heavy, burdened by its own corporate legacy and dependency on other Symantec products. Also, it is not always clear what you are enabling or disabling, clever way to keep users from controlling the application themselves. And finally, watch out for fee-based "premium" help and technical support which once again finds its way back into the product.