VB comparative review: Windows XP SP2

Trustport Anti-Virus is available as a component of the broader Trustport suite, which was reviewed in VB in some depth a couple of months ago (see VB, March 2007, p.13). The installation was thus a familiar affair. Halfway through the installation I was reminded to ensure that I had no other anti-virus solutions installed on my machine - quite a reasonable request since the four engines included with the product (BitDefender, Ewido, Grisoft and Norman) should be more than adequate for anyone.

No reboot was required at the end of the installation, and red shield and blue gem icons installed to the system tray indicated that protection was running smoothly. Accessing the configuration options from here, I found the interface sensible and highly responsive, and had on-access scanning temporarily disabled, the logging settings tuned up and the first on-demand scan under way in a matter of seconds.

With all four engines deployed for the on-demand mode, speeds were never likely to be as impressive as detection rates, but on access only two engines are in use and the slowdowns are not too severe.

With splendid detection throughout and not a false positive in sight, Trustport gets this bumper comparative off to a good start with a very well deserved VB100 award.

The first of the barrage of newcomers to join the test this month, Agnitum's product is an expansion of its well-known firewall offering, with virus detection provided by the VirusBuster engine.

Installing the product was a fairly straightforward affair, although I was asked if I wanted 'Advanced' protection (recommended for more experienced users) or a 'Normal' level (suitable for all). Since the advanced option was selected by default, I went with this mode. I was also offered an option to enable 'SmartScan', which is a system that can be used to speed up scanning using checksums of known good files, stored in hidden files. This I turned down for fairness in the speed tests, and a number of other setup options were trundled through before I could get my hands on the product proper.

The interface itself is attractive, with a tree menu showing its core functions and the product's various 'plugins', of which the 'anti-malware' section was, of course, the most interesting to me. Each has its own configuration section, some stretching to several tabs, and some detailed status information was also provided.

Scanning was performed with ease, generally from the handy context-menu link, and was fast and stable. On-access protection was similarly solid and reliable. Detection across the zoo sets was in line with the results I would expect from the engine used, but some strange behaviour was encountered in the WildList set. Two samples, both with .pif extensions, were missed in the on-demand scan, and four different items, including a full set of one of the W32/Fujacks variants, were missed on access. This behavioural oddity spoils Agnitum's chances of a VB100 at first attempt, but this product seems a likely contender for the award in future tests.

AhnLab has been a regular and successful entrant in VB's comparative reviews over the last few years, and it was no surprise to see V3 back on the test bench after a brief absence. The Internet Security suite includes the usual firewall, web and email protection facilities, from which a selection of required components could be made during installation, which also offered a pre-install scan and was ready to go without rebooting.

Initial impressions of the GUI were very good: it looked slick and attractive, with a prominent 'Settings' button promising easy access to all the required controls. Attempting to run a few scans proved a little less straightforward than I had hoped, due to the requirement to set up a job and then run it, but a 'Run a virus scan' option was added into context menus, making speed testing much easier.

Scanning speeds themselves were on the slow side on demand, especially with the option to scan archives enabled, but on-access speeds were remarkably fast, with little control of the depth of scanning available for this mode.

Logging has proved problematic with AhnLab products in the past, and this occasion was no exception. Logs saved from the Log Viewer utility were invariably truncated to an apparently random size, but usable figures were obtained eventually, after splitting the scans into several sections. These, and the results of on-access blocking, showed samples to have been missed in all test sets, though not in vast numbers. In the WildList set three separate items were not detected, including the polymorphic W32/Polip.A, of which all 15 samples were missed, thus denying AhnLab a VB100 this time around.

Alwil's avast!, one of the best-known names in the home-user field thanks to the widely used free versions, is another regular in VB comparatives, and little was changed here from previous visits. As usual, the rather funky basic interface was avoided for most tests, with the ‘Advanced’ control system providing ample functionality.

Again the system for setting up scan tasks proved a little fiddly for my purposes, but my familiarity with the interface has begun to pay off and the tests were completed quickly. Speeds were middling throughout, and detection likewise - neither flawless nor disappointingly lacking.

The product’s reliability was carried over into the WildList set where nothing was missed, and likewise the clean sets, where only the usual single file labelled a ‘Joke’ required noting. As a result, Alwil is once again the worthy winner of a VB100 award.

Authentium is another fairly regular participant in VB’s tests, with a false positive issue in last October’s test the first blot for several years on an otherwise impressive test history (see VB, October 2006, p.10). The company focuses on ‘software as a service’, but continues to sell the Command software both as a standalone product and as part of a suite including a firewall and so on.

The product itself is a simple little thing; installation seemed to spend some time pondering its surroundings, before suddenly announcing completion, and opening the GUI showed a tiny and unflashy but potent little tool. In a simple-to-use manner, it offered all the required tweaking, apart from the ability to add archives to the file types scanned on access, and zipped through the tests in excellent time.

Detection rates were similarly excellent, with barely a miss across the board, and the few missed detections were due to the file types not scanned by default. This performance, coupled with a complete absence of false positives, easily qualifies Authentium for another VB100.

Avira is another perennial high achiever in VB100 terms, and its product is another which grows pleasantly familiar with repeated use. In this case, however, familiarity adds little to the product’s ease of use, since it is well designed and easy to use from the outset.

A few things I had not spotted before include the whimsical title ‘Luke Filewalker’ given to the scanner screen, which started a scan of my system automatically after installation and had to be stopped. Several other products also carried out this auto-check, while most others offered the option of a thorough scan once they were ready to go - an option I always decline for the purposes of these tests.

AntiVir’s slogan promises ‘More than security’, and I certainly felt secure looking at the admirable detection figures, with a only a tiny handful of misses - mostly an obscure and ancient DOS virus - and splendid speeds across the board.

Again, archives could not be scanned on-access, but this does not detract from the excellent results, easily earning Avira another VB100 award.

The second newcomer to the VB test bench this month is from Bullguard, a company founded in Copenhagen in 2001. Bullguard's Internet Security suite has been available for around five years, offering a firewall, spam filter, anti-spyware and a backup system alongside virus detection provided by the BitDefender engine. The company boasts over 18 million downloads of its 60-day free trial, and also offers mobile products and chat-based online support.

The product itself, adorned with the company’s bulldog logos, looked good, with a slick and professional design lending a weighty, serious feel leavened by some friendly language in its messages, and proved responsive and solid.

Configuration was generally easily achieved, although logging seemed to be entirely absent, and my only other quibble with the interface was the greyness of some of the buttons, which often made me think the functionality in question was greyed out and thus unavailable - until I tried clicking on them.

Scanning speeds were solid, with particularly thorough scanning of archive files slowing things down a little, and results were, as expected, very impressive. There were very slightly more misses in the zoo test sets here than in the parent product, but nothing from the WildList set got past it.

This performance, combined with a lack of false positives, grants Bullguard its first VB100 award on its first attempt, and left me hoping that all the new products would present as few problems as this.

CA's home user product first made an appearance in VB in the February Vista review (see VB, February 2007, p.14), and the product submitted this time is little changed from that occasion. Installation included CA's usual trick of requiring EULAs to be scrolled all the way through, as well as a lengthy activation keycode, but once up and running the product presented no such barriers to testing.

A simple GUI was laid out in fairly standard style, and a small but reasonable amount of configuration (for a home-user product) was available. Using the handy context-menu scan option, tests were run through in good time, aided by some excellent scanning speeds. It was no surprise to find that there was no option to scan archives on access.

Detection rates were little changed from previous scores, with a smattering of misses across the zoo test sets, but nothing in the WildList. With no false positives generated in the clean set, CA's home division can celebrate a second VB100 award.

CA's corporate offering is also little changed from its last appearance in the Vista comparative - indeed, the same submission was used this time with only additional updates provided. The eTrust brand has a lengthy history in VB's comparative testing, initially using the InoculateIT engine, later swapping to the Vet engine as the default, and now offering only the Vet engine, since InoculateIT was retired late last year.

The eTrust interface has never been a favourite of mine, its server-client design leaving the browser chugging slowly along as it attempts to refresh content after every click of a button. Under Vista, where version 8.1 was last tested, this sluggishness was notably improved, but any hopes that this was down to the new version rather than the platform were quickly dispelled and testing consisted of brief moments of activity interspersed with long periods watching the ‘please wait’ message - particularly when trying to view some hefty scan logs, which threatened to overwhelm it entirely.

Despite these issues, tests were eventually completed with the usual very impressive speed during the actual scanning. After converting the logs from the .dbf format in which they are stored to a style which did not require the unresponsive log viewer, results were found to be similarly good, with solid detection and no false positives qualifying CA for another VB100 award.

CAT’s website lays claim to the title ‘India’s leading anti-virus software’. As well as the ‘Lite’ product submitted for testing, Quick Heal is available as both the ‘AntiVirus Plus’ version, with anti-spyware and firewall functionality constituting the ‘Plus’ element, and as a full ‘Total Security’ suite with the addition of spam-filtering and data theft prevention among other things.

The product greeted me with the message ‘Welcome to the world of virus-free computing’, and the built-in messenger system providing information on updates and outbreaks continued this theme of friendly communication with the user. The interface is simple, but clearly designed and easy to use, with right-click scanning used for much of the testing.

Checking the logs showed the figures to be much as expected, with a fair number of misses in most of the zoo sets, but nothing in the WildList set and no false positives. CAT is therefore eligible for another VB100 award.

Doctor Web is another VB100 regular, supporting a wide set of platforms with its product range, including Windows versions as far back as Windows 95. The XP version, the whole thing impressively compact at little over 10 MB, installs in a shiny and attractive manner, with the customary stern warnings against having other security products installed on the machine.

Using the product was made easy by familiarity, and once I had remembered that the ‘change‘ button was required to apply changes made to settings, tests were zipped through without difficulty. Unloading the on-access mode prompted a message saying that part of the SpIDer monitor system had failed to unload, but this didn’t seem to cause any lasting problems.

Speeds were somewhat slow both on demand and on access, which can perhaps be put down to very thorough scanning, particularly where archives are concerned - the product reported the largest number of ‘objects’ scanned in this test set. Detection within the zoo sets was as excellent as usual, with most of the very few samples missed being due to the file types not being scanned by default.

Doctor Web had some issues in the last comparative review, with a log parsing problem causing several detected files to be counted erroneously as misses in our initial report. In addition, a small number of W32/Sdbot samples were confirmed to have been missed from the WildList test set. Further investigations by the vendor have indicated that these samples were covered by updates to the product’s engine that were not submitted for the test along with the virus database updates, but these samples would have been protected against in a real-world setting.

Unfortunately Doctor Web was unlucky again on this occasion, and several more samples were missed, including three Sdbots and two W32/Rbots, all in the WildList set. This was enough to deny Doctor Web the VB100 award for the second time running.

Blink is another newcomer, and one of which I had little prior knowledge. Vulnerability specialist eEye Digital Security has been in business for almost ten years, spotting and reporting security flaws and creating software to keep networks free from exploitable software. Its Blink client product is a desktop offering promising a range of security features that include: vulnerability scanning, HIPS and other system protection systems, as well as firewalling and anti-malware protection, provided in part by Norman.

Installation includes the customary warning against combining the product with other security software, as well as a thorough list of products which could be expected to clash with Blink, and an assertion that running multiple products will provide no extra protection. The remainder of the installation process is slick and smooth and requires no reboot.

The interface of the product itself is similarly attractive, with an option-rich page offering controls over the full range of functionality. Scanning is designed in the typical style of an anti-spyware product, with the full system and registry the default target, but individual areas can be scanned by switching off ‘deep disk scanning’ and selecting the required folder. This gave some unusual speed results, with great attention paid to executable and binary files but little, perhaps sensibly, to media and documents.

On-access detection was obtained via the system’s logging, as blocking was not sparked by simple file-opening.

A few times during testing the display faltered somewhat, with attempts to view scan histories producing only a ‘Page not found’-type error message, but logging to file seemed more stable.

Results were good across the board, closely matching the scores recorded by Norman’s own product, and with the WildList set amply covered and a single suspicious file in the clean set, another impressive-looking piece of software gets its first VB100 stamp of approval.

The Windows version of NOD32 is another very familiar product, little changed in the last several tests, although a major new release is promised in the coming months. This should add further functionality to the current protection against malware on the local system and arriving via web and email vectors.

NOD32’s configuration is straightforward with the benefit of some experience, and tests zoomed along at the customary rapid pace.

The only option that seemed not to be available was scanning inside archives on access, and the thorough detection which has become the norm for NOD32 once again covered the entire extent of the VB collections. With not a single miss in any set and no hint of a false positive, NOD32 once again proves worthy of a VB100 award.

Fortinet focuses on business customers with a range of server products and appliances, and unsurprisingly its FortiClient product is another thorough suite, with many additions to the usual firewalls and mail filters.

As befits a corporate environment, configuration is flexible in-depth, and can be navigated with ease across the clearly designed, responsive interface.

Scans were completed in very good time, despite defaulting to scanning everything thrown at it, and Fortinet’s recent elevation to the top rank of products that miss nothing in any of our zoo sets continues, with full detection scored throughout.

A small issue with the alert popups, which got a little overloaded during the opening of thousands of infected samples within a few minutes, did not prove a significant problem. The thorough detection extended across the WildList set without a false positive in sight, thus granting Fortinet another VB100.

Iceland’s Frisk Software is another vendor whose history in VB100 testing dates back into the 20th century. This history has been an illustrious one, and the company’s detection technology is included in several other products.

F-PROT offers a clean and simple interface in bright white with shades of red and blue. Configuration is straightforward and thorough, with a simplified scanner setting available for those less interested in fine-tuning. On-access scanning is less tweakable, but does its job efficiently.

Scanning speeds were very good throughout, and detection similarly excellent, with nothing beyond the capabilities of the product if properly configured. This included the WildList set, and an absence of false positives gives F-PROT another VB100 award.

F-Secure’s 2007 suite was favourably reviewed in these pages some months ago (see VB, November 2006, p.12), and has been gathering similarly positive reviews from other testers. The product submitted for review this time was apparently slightly different from the usual F-Secure Internet Security, having been designed for rebranded redistribution, but my user experience was not affected.

However, this preview status seems to have added a few problems into the previously solid suite. An issue with the logging provided, which was previously noted in the Vista test when logs containing large numbers of detections failed to export in their entirety, was once again in evidence here. A new problem also emerged on this occasion, with a sample of W32/Wotbot causing the product to seize up somewhat on one occasion.

With these fairly minor irritations overcome, testing was eventually completed, with F-Secure’s traditional plodding thoroughness while scanning archives adding to the delays. Detection in general proved to be excellent, with the only miss in the zoo sets caused by a file type not scanned by default. In the WildList set, however, a single sample of W32/Allaple was also missed, which was enough to see a rare failure for F-Secure to achieve a VB100 award.

G DATA’s AVK product is another of those with a long history of superb performance in VB’s testing, and once more there is little fault to be found with the product.

Speeds were not as impressive as some, which is as one would expect from a multi-engine product. The product’s interface is not only visually appealing but also clearly and sensibly laid out with little left to be desired. The ever-useful right-click scanning is in evidence, and any attempt to change the settings in a way which could lead to excessive system impact or lack of protection is warned against appropriately.

The only minor quibble I had was a repetition of the grey-buttons-looking-greyed-out problem mentioned earlier, and the format of the logs being less than ideal for my personal needs. However, with no samples missed in any of the test sets, and just a few warnings about hacker tools and joke programs in the clean set, AVK racks up yet another VB100 award with ease.

Grisoft, like Alwil and Avira, makes a basic version of its product available as a free download. AVG anti-virus thus has a very high public profile, supported by a reputation for solidity and good detection. Its free anti-rootkit and anti-spyware products, backed up by technology brought in by the company’s acquisition of Ewido, are also in wide use. Grisoft also provides full-featured and integrated versions, as well as a range of server products and support for other platforms.

Also mirroring Alwil, AVG offers simple and advanced versions of its interface, neither of which is entirely straightforward. Scans were mostly initiated using the right-click method, to avoid a rather fiddly task design system, and scanning times were far better on access, where little configuration was available, than on demand.

Detection rates were little changed from previous tests, with results generally solid with a scattering of misses in each set. In the WildList set, a W32/Rbot sample was detected by the spyware side of the product, labelled as Adware and a ‘potentially unwanted program’. On access, this meant that the file was not alerted on, and although this error was apparently corrected within days of the product’s submission, it was enough to deny AVG a VB100 award this time.

This is the second appearance of Ikarus Virus Utilities in a VB comparative review - its first having been as long ago as November 2001 (see VB, November 2001, p.16). Austria-based Ikarus Software also carries a range of server products for mail and web filtering, and the product is available as a six-month free trial.

The initial download is remarkably small at only slightly over 4 MB, but this must be supplemented by the virus definition data, which for this test measured around 7 MB.

Installation was prevented initially by the need for the Microsoft .NET framework, which apparently is downloaded automatically when the installer is run with web access. With this in place, the process continued with a check for other security software which may prevent full operation, and the offer to install Adobe Reader which is needed to access the documentation (which sadly only works when running from CD and was not included in my download edition).

With the installation complete and updates added, the product showed a small status display tool with details of the scanner, updater and on-access ‘guard’, but the main interface seemed unwilling to open at first. After several attempts and a reboot it suddenly started responding, and from then on seemed to suffer no such problems. Configuration was minimal and a little difficult to fathom, but once figured out, things got moving quite nicely.

While scanning the large infected sets much of the interface faded away and refused to respond, leaving me fearing a total crash, but checking back some time later I found it had returned to normal and the scan completed without serious incident.

On-access scanning was easier to run through, and analysis of the results showed good speeds, though detection across the infected sets was a little uneven, with a significant number of misses in the older DOS and polymorphic sets. These figures are magnified by some large sample sets however, and overall percentage scores are more impressive.

More importantly, a small handful of WildList viruses were missed, and several false positives were alerted on, including components of the Nero CD recording software, Norton Ghost and the GoogleTalk installer, all of which were labelled as trojans. This was enough to deny Ikarus its first VB100, but with a little work the product should be a solid contender for qualification in the near future.

Best known for its repair and optimization products, iolo has built a considerable public profile with its presence on the shelves of high-street software outlets. The company’s range of anti-virus and firewall products also includes a full security suite. Having previously licensed the Kaspersky engine, iolo now uses technology from Authentium, in addition to some ideas of its own.

Having heard from iolo some time in advance of this test, I was lucky enough to have had a look at the product in advance and get to know its workings. The installation was smooth and unproblematic, although it spent some time getting ready for action. The interface looks thorough, crammed with information without being cluttered, and appears to have ample configuration options.

Logging seemed only to kick in when some kind of disinfection or removal took place, so scanning alone was not possible. The default setting, which involved quarantining most items, took an excessively long time when dealing with large numbers of infected files and seemed to get stuck every few thousand, locking down the interface and requiring a reboot to fix. This is not a likely scenario outside the test lab, however, and is most unlikely to affect users; setting it to delete without quarantining circumvented the problem.

Speeds over clean files were excellent in both modes, with no further crashes experienced, and detection seemed thorough throughout. However, two PowerPoint files in the clean set were labelled as infected, and a single WildList file was missed in both modes, with another missed on access only, which means iolo will have to try again to achieve VB100 certification.

K7 Computing, based in Chennai, India, is yet another name that is new to the VB test bench, but again the firm is far from new to the game, having produced its first anti-virus product as long ago as 1992. Along with the Total Security suite seen here, which includes firewall and anti-spam functions, a standalone anti-virus product and a corporate edition are also available.

The installation process was a smooth and clean operation, and ends with a ‘news and update’ screen carrying useful information. This was, in fact, one of the only products to point out that my lack of web connection was the reason the product could not update itself. The interface showed similar attention to detail in its clear and user-friendly design, and was steady and responsive throughout.

Scanning speeds were excellent at all times, and while detection was not perfect on the less current test sets, especially the aging and less relevant DOS set, this was far from surprising for a newcomer not using anyone else’s technology. K7 has clearly been working hard on the latest threats and achieved full coverage of the WildList set. With just a couple of items in the clean sets adjudged to be ‘riskware’, K7 can proudly claim its first VB100.

Kaspersky’s product is a far more familiar one, having been the subject of another thorough review in VB a few months ago (see VB, September 2006, p.16). The installation and use of the product were thus straightforward, and all the tests were sprinted through in good time, although things were slowed somewhat by the need for a reboot after install and some seriously in-depth scanning of archives.

Detection figures were mostly as excellent as ever, with a pair of misses in one zoo set attributable to the file types ignored by default on access. Unfortunately, however, the same sample of W32/Allaple that upset F-Secure’s chances of a VB100 was missed here. Investigations have shown that detection was in place both a few days before and a few days after our test, and was presumably removed temporarily for some fixing. This unfortunate timing was enough to spoil Kaspersky’s recent solid record of VB100 awards.

McAfee’s corporate desktop product was submitted for this test, and was unchanged from previous tests. It is a solid and businesslike product, with its operation and configuration thorough and lacking in either excessive simplification or over-complex razzle-dazzle.

The only confusing aspect remains the inability to deactivate on-access scanning from the main interface (it can be switched off with ease from the system tray). Scanning speeds were good, and detection excellent, with only a small handful of DOS samples missed. Another VB100 is awarded to McAfee without further ado.

Forefront is Microsoft’s long-awaited corporate client product, a new implementation of the scanning technology provided for the home user market in OneCare. The final release to market is expected to be at around the same time as the publication of this review.

Things got off to a shaky start when my first stab at running the installation CD on a test machine proved a dead loss, the installer failing with an obscure error message. Resorting to the documentation, I found to my horror some lengthy instructions for the design of a security topology, which required a Windows 2003 server on which to run the installer and from which to deploy to clients - this also needed such delights as Microsoft SQL Server 2005 SP1, IIS and ASP.net, the .NET framework 2.0, MMC 3.0, GPMC SP1 and WSUS. While making moves to acquire these items, I asked the developers for a simpler client install method, which thankfully was provided and proved ample for my needs.

The user interface seemed rather simple, with less configurability than I would expect from a corporate product. Presumably most of this side of things is controlled from a proper management server, where available. Running most of the testing was fairly straightforward however, with the only problem being a complete absence of internal logging – detection details had to be gleaned from the system event log.

Scanning speeds were fairly reasonable, and detection seemed pretty thorough overall, Microsoft having made some efforts at improving its coverage since the recent appearance of OneCare in VB’s Vista test.

Some slightly unusual behaviour was uncovered when a single file in the WildList set, a sample of W32/Tenga, was not blocked on access. Further investigation showed that the default action for this file was set to ‘always allow’ (after detecting the file in an on-demand scan, selecting the ‘apply action’ option either deleted, disinfected or quarantined other items, while this one was for some reason allowed to pass unfiltered).

Despite this problem, basic detection of the file was provided, and thus without having generated any false positives in the scan of the clean test set, Forefront just about qualifies under the rules of the VB100 award.

My second attempt at testing OneCare was aided by some familiarity with the product, and with the special setup required to allow this web-centric software to operate without its connection to base. Installation was at first hindered by some mysterious errors, but this was soon diagnosed, with help from the developers, as being due to my system using the UK locale, for which the appropriate language packs were not included in the pared-down version provided for my test.

My experience with the interface paid off and the tests were completed without further issue, with scanning speeds a fraction slower than OneCare’s corporate sibling and detection rates just as good. Among the other functionality included was an offer to ‘tune-up’ my system, with disk defragmentation etc.

Limited configuration did not extend to logging, and results, once parsed, showed full detection of the WildList, and again no false positives, so OneCare is also granted the VB100 this time.

Microworld Technology provides a wide range of server and gateway products alongside those for desktops, including Linux. The installation of eScan complained at first about the date on my test machine, which for some reason was set to before the creation date of the product. With this small issue resolved, the installation continued simply and rapidly, and required a reboot to activate fully. The interface was a little odd-looking, but fairly simple to use throughout my tests, and speed times reflected the thoroughness of the Kaspersky engine at the heart of the product. Thoroughness was also a feature of scans of the infected sets. I spent a long time watching the amusing animation of a hand crushing an insect which accompanied detection, along with a wildly inaccurate progress bar. Microworld’s submission seems to have missed the small window during which the Kaspersky engine missed detection of the W32/Allaple sample, and also had more complete defaults, resulting in 100% detection across the board, and with only a single piece of software labelled a risk, eScan wins another VB100 with some style.

Norman is another familiar face in VB’s testing, and again familiarity with the rather unusual layout of the product rendered testing less of a chore than it once was. The availability of a right-click option, starkly labelled ‘Norman Virus Control’, also helped speed things along.

On-access scanning has always been somewhat odd in the Norman product, with little control of its behaviour available, and logging was a little flaky here, requiring several attempts to get a full list of detections. Scanning the WildList seemed to show a batch of files never blocked when opened, but access to those tricky logs showed that detection was indeed in place and some allergy to the testing tool in use was diagnosed as the likely cause of the oddity.

Overall, results were shown to be very good, with no false positives and some pretty decent times in the speed tests. With the WildList covered without difficulty, Norman also wins a VB100.

NWI is the abbreviation of New Technology Wave Inc., a Korean operation whose VirusChaser product is an implementation of the Dr.Web scanning engine aimed at the Asian market, and is provided in an even smaller package - this time a mere 7 MB in total.

Installation was thus simple and fast, and the clear and straightforward GUI offered more configuration of its own appearance than of actual scanning behaviour. Many tests were nevertheless carried out fairly easily using the context-menu option, and zipped along very rapidly.

On-access scanning seems not to be sparked by simple file opening, and as a result speed times were not measurable for comparison, but detection was instead measured by copying files to the machine.

Logs showed detection rates to be slightly below the level achieved by the parent product, along with a broad set of applications labelled ‘Riskware’. Unfortunately for NWI, the product missed the same clutch of WildList samples as Dr.Web, as well as a handful of others, which means that no VB100 is awarded to NWI this time either.

The first of two submissions from PC Tools, this is the company’s standalone anti-virus product, which was first released in late 2005 and is assisted by VirusBuster technology. A basic version of the product is also made available as a free download. Alongside its anti-malware range, PC Tools also offers a selection of system repair, recovery and cleanup products, privacy tools, a spam filter and a firewall.

The product installed rapidly and simply with few choices to be made, and launched an attempt to update without prompting. Oddly, this reported that the product was up to date, despite having no web access from within the test lab, and the brightly coloured interface’s status page also misleadingly reported that ‘the last update was today’.

The GUI was simply laid out, and testing ran through without difficulty. Some hefty XML logs proved a little much for my poor tired system to bear, but scanning speeds were good and results looked promising. On-access behaviour was a little unusual too, with access to some files denied and other detections merely logged, while a cascade of alert messages gushed down the right-hand side of the screen.

In both modes, the product had difficulty with a couple of files in the clean set, which it got stuck on, refusing to go any further. On demand, trying to stop the snagged scan simply led to a ‘stopping...’ message, and only a reboot moved things along. With the ‘On Guard’ on-access scanner switched on, perusing files from Explorer slowed to a rather frustrating degree at times, especially while trying to analyse the large logs created.

With these issues surmounted, detection results were finally obtained and results proved pretty thorough across all the sets. The WildList was completely covered, with no false positives, adding PC Tools to the roster of new VB100 winners this month.

Spyware Doctor is PC Tools’ long-standing flagship product, a widely trusted anti-spyware tool into which virus detection and protection has been added.

The installation process and appearance of the interface are similar to the previous product, colourful and curvy and aimed squarely at the home user, although this one had some more complex configuration and a lengthy list of scanning types from which to select when kicking off a localised scan.

Logging proved a little tricky again here, with output generally truncated, but results were gathered easily by setting it to delete infected items from the test sets and seeing what was left behind. On-access detection was also unusual, with no blocking of simple file access possible and so no speed figures for this mode were available, but the slowdown was fairly noticeable to the naked eye from time to time. Detection on access was measured by copying files to the system and having them deleted.

The same two files in the clean set caused problems, but once the snags were overcome no false positives were reported, on-demand scanning speeds were reasonable, and detection rates were good too, although Spyware Doctor missed a small set of DOS samples caught by its sister product. Everything else proved fine though, and a second VB100 is duly awarded to PC Tools.

Proland is another vendor that is neither a complete newcomer to VB’s comparative testing nor a regular. The vendor’s products previously appeared in several comparative reviews in the late 1990s, and Proland returns after a lengthy absence and recent acquisition.

Protector Plus is another contender for the accolade of most compact product, with the whole thing weighing in at around 8.5 MB, and again a slick and speedy installation reflects its small size. The process looks good too, and offers but does not force a system scan. The option is also provided to add support information to the Windows address book.

This attention to user needs was shown throughout, with lots of helpful advice, and the product’s interface was attractive and well designed. It also ran well, with no freezes or crashes or other unwanted behaviour despite the heavy load of the tests.

Checking through results revealed some superb scanning speeds, as expected, and also a fair number of misses across all the zoo sets, with particularly low coverage of older samples. A couple of WildList samples were likewise missed, with several more missed on access thanks to some incomplete coverage of file extensions. This, along with the presence of two false positives, means that Proland will also have to do a little more work before qualifying for a VB100 award.

BitDefender is a more well-established product, with its advanced heuristics making it a popular choice for other software makers looking for an extra engine.

The company’s own implementation includes most of the standard extras, with a firewall, spam and web filters and anti-spyware functionality included, as well as the ‘B-Have’ behavioural intrusion-spotter.

The product boasts that it is ‘a superior software package’, and it certainly looks sleek and solid. The ‘Activity Bar’ that hovers in a corner of the screen, semi-transparent, has always been a bit of a mystery to me, and the interface itself is similarly quirky and unusual, but its nice deep red colour scheme oozes professional slickness and solidity.

Scanning was soon under way once I had re-familiarised myself with the controls. Speeds leaned towards the thorough rather than zippy, and detection rates towards the very top end with only a handful of missed samples. None of these were in the WildList set, and no false positives were recorded either, thus qualifying BitDefender for another VB100 award.

Sophos rarely misses a chance to enter a VB comparative review. Despite a major new version of the associated management tools and the addition of an optional firewall late last year, the end-user experience has remained little changed for some time.

Installation and use skipped along simply, with the in-depth configuration available making for easy testing. Some improvements in detection have removed the small number of obscure samples regularly missed in previous tests, and the only remaining misses are in Access database files, ignored by default to avoid problems with Sophos’s corporate customer base, who can be expected to have extremely large databases.

These same customers are also served by warnings about some system tools which could present a hacking risk on a corporate network, but no actual false positives and full detection of the WildList set earn Sophos a VB100.

Symantec also targets the corporate market with the product submitted here, which has a serious and text-heavy feel with none of the cuddly graphics home users are generally assumed to require. Again, my familiarity with the workings of the product allowed me to complete the tests in record time.

Scanning speeds were good, although surprisingly I could find no way of activating on-access scanning inside archives.

Detection was reliably thorough, with only a tiny number of DOS samples missed, and this thoroughness extended to the WildList test set. In the clean sets a single file was flagged as suspicious, but there was nothing to prevent Symantec from winning a VB100 award.

Trend Micro’s suite was reviewed in depth last month (see VB, May 2007, p.14), and is still installed on a few of my spare test systems, so no trouble was expected. The product is well-designed throughout, both visually appealing and easy to navigate, and includes several useful ideas.

During installation I was informed that the Windows firewall would be deactivated, to be replaced with the product’s own firewall. I was also presented with a list of vulnerabilities detected on my bare system for which patches have since been released.

Detection was decent, if not among the most thorough, but nothing from the WildList was missed and no mistakes were made in the clean sets, resulting in another VB100 for Trend Micro.

VirusBuster is, for once, not the last product in this test alphabetically - but the offering is one that I never mind getting around to at the end of a test period, with its clear and logical design and pleasing stability.

While the layout of the on-demand scanning system is not my favourite, right-click scanning avoided much need to use this, and gave good speed results and a small selection of missed files in the zoo sets.

VirusBuster’s engine has already appeared in this test, implemented in some of the newcomers’ products, but the problems exhibited there were not in evidence here, and with only a warning that a zipped file in the clean set may be an attempted zipbomb, VirusBuster wins another VB100 award.

The final product on the list is yet another newcomer. Webroot’s Spy Sweeper has long been a popular and well-regarded player in the anti-spyware field; the company has been around for over ten years, and also produces firewall, performance management and content-filtering software. Spy Sweeper added anti-virus protection and detection late last year, incorporating the Sophos engine into version 5.2 of the product.

Installation of Spy Sweeper was a simple process, although some tweaking was required to add in the anti-virus components, which would normally be downloaded from the web separately from the main console. These were clearly recognisable as many of the parts that make up the Sophos product.

The interface is clear and simply laid out with the colourful style expected from home-user-focused anti-spyware offerings. Control of the various settings is available from several tabbed screens including those marked ‘Shields’ and ‘Options’, although these were heavier on information than actual controls.

On-demand scans were run from a tab labelled ‘sweep’, and were straightforward to set up and run. Here again little deep configuration was available, but it proved sufficient for my needs, and judging by the slowish speeds achieved on demand, scanning appears to default to fairly thorough settings.

On-access scanning speeds were considerably faster, and among the most impressive in this month’s set of products. This led me to suspect that settings here leaned towards the lax, ignoring many file types entirely. However, this proved not to be a problem where detection of the test sets was concerned. While, once again, blocking access completely did not seem to be possible, detection of malware as files were opened clearly took place, and thorough logs were produced.

The logs included useful data on the malware found, as well as warnings whenever scanning a file took longer than a few thousandths of a second. The logs also listed the vast majority of the samples in the sets, including everything rated In the Wild. With an impressive performance overall, congratulations go to Webroot for claiming a VB100 award on its first attempt.