Symantec Norton Security PCmag review

[Petrovic]

Hands On With the Antivirus
The test results from the big independent labs are certainly useful, but I like to run my own tests, to get a hand-on feel for how each product works. The test starts when I open a folder containing my collection of malware samples. It's not uncommon for a security product to immediately wipe out most of the samples. Bitdefender Total Security 2015 and F-Secure Internet Security 2015 both wiped out more than 80 percent of the samples on sight.

Norton's approach is different, with much less reliance on simple signature-based detection. It wiped out 28 percent of the samples on sight, but blocked and quarantined most of the rest when I tried to launch them. With an overall detection rate of 89 percent and an overall score of 8.3, it's just a hair behind Bitdefender.

You'll notice in the chart that many products tested using my previous malware collection scored quite a bit higher. Since it was a different collection, scores aren't directly comparable. And I do give more weight to results from the independent labs.

Good Malicious URL Blocking
My malicious URL blocking test starts with a feed of newly discovered nasty URLs supplied by MRG-Effitas. I launch those that point directly to malicious executables, noting whether the security product blocked access to the URL, quashed the download, or simply did nothing. Despite being just a few hours old, many of the URLs are already no good. I keep at it until I have data for 100 URLs.

Most of the time, every product goes up against a different set of URLs—but always the very newest. This time I was able to test Norton simultaneously with McAfee AntiVirus Plus 2015 Testing took a little longer, because I discarded any URL that returned a "not found" error for either test system.

Norton blocked all access to 21 percent of the URLs, and it quarantined another 30 percent during or immediately after download. A block rate of 51 percent is definitely good; the average since I began this test is 32 percent. However, Trend Micro Internet Security 2015 blocked 80 percent of the malicious URLs, and McAfee, the top scorer, blocked 85 percent. Given Norton's consistently excellent phishing protection, I had expected better.

Varied Scanning
A full scan of my standard test system took Norton 26 minutes, which is precisely the current average time. I like the fact that the antivirus deals with malware immediately, without waiting for the scan to complete. On completion of the scan, it reported its actions, and asked what to do with a couple of low-risk items.

A repeat scan took seven minutes, which is good. However, a repeat scan with F-Secure took just four minutes, and with Trend Micro the repeat scan lasted less than one minute.

The Norton Insight scan checks the programs on your computer and charts which are trusted, good, unproven, or poor. For each file it also reports prevalence among Norton users and identifies whether the program's resource usage is low, moderate, or high.

Another scan creates a diagnostic report that flags any problems with your system. It also gathers detailed information about your hardware, software, network connection, and more. This report can be handy if you find that you need to contact tech support.

Antiphishing Champion
Norton is the touchstone I use for measuring how well other products can detect and block fraudulent (phishing) websites. I scrape newly reported phishing URLs from various websites—URLs so new they haven't been verified as frauds. I simultaneously attempt to visit each URL on five systems protected by Norton, the product under testing, Internet Explorer, Firefox, and Chrome. I repeat the process over a few days, always using the freshest phish, until I have about 100 samples.

Norton consistently detects almost all of the fraudsters, and Internet Explorer consistently lags way behind. Chrome is more volatile, as this test shows. Frequently Chrome's built-in phishing detection comes in almost as accurate as Norton. This time its detection rate lagged 27 percentage points behind Norton. Firefox's showing was even worse, at 47 percentage points behind.

Intelligent Firewall
Norton's firewall is the poster child for smart and silent firewall protection. To start, it correctly stealthed all the system's ports, and it resisted all the Web-based attacks I threw at it. That's important, but it's just a baseline; the built-in Windows Firewall can do the same.

The firewall also controls how programs are permitted to use the network and Internet connections. It automatically configures permissions for known good programs identified in the massive Norton Insight database. Naturally it wipes out known bad programs as soon as they're detected. When it encounters an unknown program, it monitors activity and steps in to block any malicious behaviors.

It's a tough firewall, too. Its Registry settings are protected against modification, so I couldn't turn it off that way. Terminating its processes using Task Manager just got me "Access denied." And I couldn't make any changes to the status of its single Windows service. That's a refreshing change from McAfee, which requires 12 distinct services and only protects five of them.

Malicious websites can breach system security by exploiting vulnerabilities in the operating system, the browser, or a variety of popular programs. In order to succeed, an exploit attack needs to hit a system whose configuration precisely matches the vulnerable program version. If you keep your system patched, you're not likely to fall victim. Even so, you'd surely want to know about any attempted attack. Norton is the absolute champion when it comes to detecting and blocking exploits.

I attacked my test system using about 30 exploits generated by the CORE Impactpenetration tool. Norton detected and blocked every single exploit, identifying a quarter of them by the precise CVE (Common Vulnerabilities and Exposures) number of the attack. No other firewall I've tested comes close.

Sub-Ratings:
Note: These sub-ratings contribute to a product's overall star rating, as do other factors, including ease of use in real-world testing, bonus features, and overall integration of features.
Firewall:

Antivirus:

Performance:

Antispam:

Privacy:

Parental Control:

Full Article

 

[Anupam]

I do not like the bad detection of norton. Behavioral blocking and sonar is good but I like it when Antivirus detects even before executing.

 

[kiric96]

Umm in my personal opinión Norton is not good enough:
good:
good phishing filter (but no great, in some cases the plugins may slow down your browser)
good sonar (it is not like playing russian roule)
light on system resources
good system cleanup (left traces and non executable files)
excelent file rep

bad:
It may crash a lot.
it is very hard to make it work (if something happen, like a service shutdown)
very bad customer service (1)
VERY LOW detection rates
scan takes ages and removal is even worst (if your system is infected or no, it may take 3-10 minutes to remove an unactive malware) /eset does this (..) just in a matter of milliseconds/ (3) also some times it can take a lot of resources
updates are so heavy
it relies on the cloud (2)

(1) my last infection was with a vbs malware, called avast.vbs which infected my pc via usb (the malware was active in some pc in the campus university) by that time i think that just 3 or four AV detected the malware, I sent the sample to AVG; NORTON; ESET and AVAST, they add the sample immediately but Norton was taking some time to do so... i contacted with customer service and explained my case, after 1 hour online checkup, they told me that my pc was clean (of course it was not true). So i decided to manually clean up the pc, after this (knowing what the file does) I reinfected my pc and then contact with then, after i explain and show the malicious script they told me that was a file created by avast! (i have never installed that product before). After 30 minutes showing them the infection vectors, they were still saying it was a safe file, at the end i showed a Vrtotal report and finally they said that they will investigate it... (they refuse to take a sample of the file, they told me that all actions carried out with remote desktop was monitored). After 4 days they finally add the detection... of course i changed my AV.

(2) As all of us we know Norton has a very low detection rate. But in particular most of the detecions are based on the cloud, making and offline test Norton get a worst score on virus scan. Although SONAR can accurately remove malware. I think that relying on a module that guess if a file is harmless or no it is not a good idea.

(3) once a classmate asked me to clean his usb, it was a minor infection (just to delete the recycler folder, you can do it by yourself) Norton took 10 minutes to delete just a file. Dont tell me that it was something in my pc that was affecting Norton´s performance because i formatted it 3 times and Norton was behaving just in the same way.

I still like some features that Norton provides, like the build in network map, or the excelent filerep, but i think that needs a lot to improve

 

[ifacedown]

Umm in my personal opinión Norton is not good enough:
good:
good phishing filter (but no great, in some cases the plugins may slow down your browser)
good sonar (it is not like playing russian roule)
light on system resources
good system cleanup (left traces and non executable files)
excelent file rep

bad:
It may crash a lot.
it is very hard to make it work (if something happen, like a service shutdown)
very bad customer service (1)
VERY LOW detection rates
scan takes ages and removal is even worst (if your system is infected or no, it may take 3-10 minutes to remove an unactive malware) /eset does this (..) just in a matter of milliseconds/ (3) also some times it can take a lot of resources
updates are so heavy
it relies on the cloud (2)

(1) my last infection was with a vbs malware, called avast.vbs which infected my pc via usb (the malware was active in some pc in the campus university) by that time i think that just 3 or four AV detected the malware, I sent the sample to AVG; NORTON; ESET and AVAST, they add the sample immediately but Norton was taking some time to do so... i contacted with customer service and explained my case, after 1 hour online checkup, they told me that my pc was clean (of course it was not true). So i decided to manually clean up the pc, after this (knowing what the file does) I reinfected my pc and then contact with then, after i explain and show the malicious script they told me that was a file created by avast! (i have never installed that product before). After 30 minutes showing them the infection vectors, they were still saying it was a safe file, at the end i showed a Vrtotal report and finally they said that they will investigate it... (they refuse to take a sample of the file, they told me that all actions carried out with remote desktop was monitored). After 4 days they finally add the detection... of course i changed my AV.

(2) As all of us we know Norton has a very low detection rate. But in particular most of the detecions are based on the cloud, making and offline test Norton get a worst score on virus scan. Although SONAR can accurately remove malware. I think that relying on a module that guess if a file is harmless or no it is not a good idea.

(3) once a classmate asked me to clean his usb, it was a minor infection (just to delete the recycler folder, you can do it by yourself) Norton took 10 minutes to delete just a file. Dont tell me that it was something in my pc that was affecting Norton´s performance because i formatted it 3 times and Norton was behaving just in the same way.

I still like some features that Norton provides, like the build in network map, or the excelent filerep, but i think that needs a lot to improve

Hello...

I am currently using ESET NOD32 8 and is quite happy with it. However, Symantec emailed me giving me FREE 10-user 1 yr license for Norton Security w/ Backup for being a beta tester. Should I grab it in exchange for ESET which is rock solid for me? And super light as well?

 

[Anupam]

Hello...

I am currently using ESET NOD32 8 and is quite happy with it. However, Symantec emailed me giving me FREE 10-user 1 yr license for Norton Security w/ Backup for being a beta tester. Should I grab it in exchange for ESET which is rock solid for me? And super light as well?

Use ESET. And if possible share the norton key with me

 

[frogboy]

Use ESET. And if possible share the norton key with me

Pure Gold. Best comment i have seen here yet.

 

[kiric96]

Hello...

I am currently using ESET NOD32 8 and is quite happy with it. However, Symantec emailed me giving me FREE 10-user 1 yr license for Norton Security w/ Backup for being a beta tester. Should I grab it in exchange for ESET which is rock solid for me? And super light as well?

It will depend, if you are always online Norton will be enough to protect you, if not, well go ahead with ESET, but remember that ESET doesnt provide good heuristic protection /norton is better/ you should evaluate your conditions and requirements and then make a decision.

Use ESET. And if possible share the norton key with me

emmm dont be that fast men xD

 

[Tony Cole]

The only problem with SONAR is the response time i.e., you run a piece of ransomware - encryption could start before SONAR detects the malware, and acts accordingly.

 

[darko999]

Norton FP ratio is high, and it's detection average. There are better choises outhere.

 

[FleischmannTV]

The only problem with SONAR is the response time i.e., you run a piece of ransomware - encryption could start before SONAR detects the malware, and acts accordingly.

SONAR is only one part of Norton's components, the others would have to fail as well. I suppose Download Intelligence will catch most stuff before it even has the chance to execute and exercise suspicious behavior. For what it's worth I don't know 100% how behavioral monitoring works in Norton, so suspicious activities might as well be rolled back. Further ransomware has to do some things in advance before the encryption process can start and this is where SONAR will likely chime in and disrupt it.

Norton FP ratio is high, and it's detection average. There are better choices outhere.

I politely disagree. Symantec has the biggest and best reputational cloud database in my opinion. This is an important factor in threat classification, both in terms of avoiding false positives as well as removing files simply due to low reputation as well automatically adjusting detection components' aggressiveness once files with low reputation are introduced to the system.

I agree though that Download Intelligence may throw up false positives when executable files with very low reputation are downloaded, yet this is also a very important factor in combating the introduction of malware to the system through social engineering. Download Intelligence is actually quite unique in this industry and other vendors probably cannot use such a system because they don't have a comparable intelligence network in order to avoid false positives.

Regarding bad detection I fell inclined to disagree more emphatically. It is true that Norton may look worse with bulk malware packs than other vendors, yet this is only the signature part. Most people don't execute these files, so there isn't even a chance for the other components to step in. Further Download Intelligence cannot protect you when you intentionally download password encrypted malware packs, hence you give malware the ability to run which would have been swiped away by Download Intelligence, if it had been introduced to the system by conventional means.

In addition you have to consider Symantec's resources. They are a very important factor in discovering the latest and most severe threats. When you take the really severe and new stuff into account, Symantec is probably regularly going to be among the first to detect and classify them.

When you count potentially unwanted programs to detection as well, I agree they should be more aggressive. In my opinion you cannot be aggressive enough against these junk peddlers and Symantec has the financial resources to make any third-rate junk peddler think twice before he tries to file a law-suit against them. Smaller companies which are much more vulnerable against civil litigation afford this aggressive stance and so should Symantec.

 

[darko999]

SONAR is only one part of Norton's components, the others would have to fail as well. I suppose Download Intelligence will catch most stuff before it even has the chance to execute and exercise suspicious behavior. For what it's worth I don't know 100% how behavioral monitoring works in Norton, so suspicious activities might as well be rolled back. Further ransomware has to do some things in advance before the encryption process can start and this is where SONAR will likely chime in and disrupt it.



I politely disagree. Symantec has the biggest and best reputational cloud database in my opinion. This is an important factor in threat classification, both in terms of avoiding false positives as well as removing files simply due to low reputation as well automatically adjusting detection components' aggressiveness once files with low reputation are introduced to the system.

I agree though that Download Intelligence may throw up false positives when executable files with very low reputation are downloaded, yet this is also a very important factor in combating the introduction of malware to the system through social engineering. Download Intelligence is actually quite unique in this industry and other vendors probably cannot use such a system because they don't have a comparable intelligence network in order to avoid false positives.

Regarding bad detection I fell inclined to disagree more emphatically. It is true that Norton may look worse with bulk malware packs than other vendors, yet this is only the signature part. Most people don't execute these files, so there isn't even a chance for the other components to step in. Further Download Intelligence cannot protect you when you intentionally download password encrypted malware packs, hence you give malware the ability to run which would have been swiped away by Download Intelligence, if it had been introduced to the system by conventional means.

In addition you have to consider Symantec's resources. They are a very important factor in discovering the latest and most severe threats. When you take the really severe and new stuff into account, Symantec is probably regularly going to be among the first to detect and classify them.

When you count potentially unwanted programs to detection as well, I agree they should be more aggressive. In my opinion you cannot be aggressive enough against these junk peddlers and Symantec has the financial resources to make any third-rate junk peddler think twice before he tries to file a law-suit against them. Smaller companies which are much more vulnerable against civil litigation afford this aggressive stance and so should Symantec.

Well, for the past couple of days on the Malware hub sub forum it has been detecting between 3 to 4 out of 12 infected files, this is an always stuff. In these malware packs I haven't seen Norton getting a 100%.
Also in the past I tested it and was quite bad. It blocked all my "Unknown" files which were legit files, and it zero day detection was awful as well.

 

[Maxxx58]

Hello...

I am currently using ESET NOD32 8 and is quite happy with it. However, Symantec emailed me giving me FREE 10-user 1 yr license for Norton Security w/ Backup for being a beta tester. Should I grab it in exchange for ESET which is rock solid for me? And super light as well?

if possible share the norton key with me. I wanna try version 2015 of Norton

 

[frogboy]

if possible share the norton key with me. I wanna to try version 2015 of Norton

I wish i could but already installed on 3 PC be good if i could because i am no security expert. It would be good to see what is happening if it is Norton or me.

 

[Ink]

if possible share the norton key with me. I wanna to try version 2015 of Norton

You do not need a license to use the 30-day trial of Norton Security. http://uk.norton.com/norton-security-antivirus

Please note:

Please do not post a thread asking for a license or software.

http://malwaretips.com/threads/plea...veaways-contests-and-sweepstakes-forum.34924/

 

[Maxxx58]

You do not need a license to use the 30-day trial of Norton Security. http://uk.norton.com/norton-security-antivirus

Please note:

http://malwaretips.com/threads/plea...veaways-contests-and-sweepstakes-forum.34924/

I'm sorry about this

 

[frogboy]

I wish i could but already installed on 3 PC be good if i could because i am no security expert. It would be good to see what is happening if it is Norton or me.

I am here to learn as much as i can. learnt a fair bit so far. All help is welcome. Thanks.

 

[ifacedown]

License keys not working anymore.

 

[frogboy]

License keys not working anymore.

Why do you know what happened as i have same keys but have not used mine yet? Bit of a bummer.

 

[ifacedown]

It says in their letter. If not used by December 15, then, poof! Gone!

anyway I don't mind. I can use ESET for some years more --- for free.

 

[Maxxx58]

It says in their letter. If not used by December 15, then, poof! Gone!

anyway I don't mind. I can use ESET for some years more --- for free.

How can you use ESET for free in some years?