The ongoing arms race of cybersecurity and countermeasures has become incredibly advanced and complicated. More often than not, finding a software or hardware exploit requires competent crafting of carefully constructed contraptions. However, even in 2026, you'll occasionally find a simple vulnerability like the recently published Zombie ZIP, which allows malware payloads to bypass nearly every common antivirus solution.

The concept is as straightforward as they come. The first part of a ZIP file is called a header, and it contains information about the contents and how they're compressed. If you make a ZIP that lies by saying the contents are uncompressed, but actually contains compressed data, most antivirus solutions won’t even raise an eyebrow.

To that software, the "uncompressed" data just looks like random bytes, and thus doesn't match known malware signatures. Evoking Westworld, "it doesn't look like anything to me." At the time of this writing, six days after the vulnerability went public, 60 out of 63 common antivirus suites don't catch this proverbial sleight-of-hand — a success rate of just over 95%.

The archive file will fail to extract with common tools like 7-Zip or WinRAR because it's technically corrupted. However, it's trivial to combine it with a tiny, seemingly innocuous program that understands the slight mismatch and extracts the actual malware.

The researcher who discovered the vulnerability published a proof-of-concept in Python that requires roughly a dozen lines of code. This is concerning enough for the average user, but it can become a nightmare scenario for corporations with thousands of users and sensitive data to protect.

If you're wondering why AV solutions won't just target the loading scripts, it's because the number of false positives would almost certainly be enormous, since loading zipped data is such a common operation in most software, including but not limited to games.

The CERT is already on the case and has published the VU#976247 advisory. Likewise, CVE-2026-0866 has already been assigned. Until security suites catch up, systems administrators should be particularly wary of ZIP files traveling through their networks.

Kaspersky, which is prohibited from selling its products in the United States due to national security concerns, has expanded into the Linux market. The Russian cybersecurity firm has ported its flagship antivirus software for Linux at an initial price of $53.99 for the first year, rising to $89.99 thereafter. With this new offering, Kaspersky is targeting Linux home users outside the United States.

It is widely recognized that Microsoft Windows constitutes the most predominant operating system targeted by infiltrators. Conversely, Linux and macOS are comparatively less susceptible, yet not entirely invulnerable. Nevertheless, Linux has been a frequent target for malicious actors, primarily because most servers and cloud providers worldwide run Linux. Given this trend, there exists an opportunity for cybersecurity firms to capitalize and offer antivirus protection to consumers. Kaspersky is consequently leveraging its reputation to introduce its antivirus software to the Linux market.

Kaspersky, like many other providers, offers tiered plans. Kaspersky Standard is the regular antivirus software; meanwhile, Kaspersky Plus and Kaspersky Premium are comprehensive internet security and total security solutions, respectively, with additional features such as a VPN, password manager, wallet protection, and more.

Regarding pricing for a single device, Kaspersky Standard starts at $59.99, while Kaspersky Plus and Kaspersky Premium cost $79.99 and $89.99, respectively. First-time Linux users are eligible for a discount of up to 40% for the first year.

Kaspersky Antivirus For Linux Pricing

Kaspersky for Linux supports 64-bit Linux distributions, including Ubuntu 24.04, ALT Linux 10, Uncom 2.3.5, and RED OS 7. The company provides its installer in DEB and RPM package formats. The minimum system requirements will be a joke to some. It asks for a Core 2 Duo 1.86 GHz processor, 2GB of memory, 1GB of swap space, and 4GB of available disk space.

Kaspersky emphasizes that the Linux version does not meet GDPR compliance standards. Like competitors, the company offers a 30-day free trial of Kaspersky for Linux, allowing you to evaluate the software before committing. At an annual cost of $59.99, Kaspersky for Linux presents a challenging proposition, particularly within a community where antivirus software is not a priority and political opinions are divided. Additionally, ClamAV—a widely-used, free, and open-source antivirus solution—remains prevalent within the Linux community.

With Windows 11 22H2, Microsoft introduced a new component to its security suite, aiming to prevent malicious applications, dubbed Smart App Control (SAC). This feature complements Microsoft Defender, blocking untrusted or unknown code from executing on a proactive basis. Now, in an updated blog post pushing the feature, Microsoft claims a performance boost compared to traditional AV solutions, though small print indicates you will require a fresh Windows installation to use this feature.

Traditional antivirus software, such as Microsoft Defender, adopts an "Innocent until proven guilty" approach. These solutions are largely reactive, trusting programs until their behavior triggers an alert. Microsoft Defender employs signature-based detection, behavioral checks (heuristics), and cloud protection to prevent malicious software on your system. When faced with novel (zero-day) malware or polymorphic threats, which can bypass signature checks, Defender falls back to heuristics, observing the malware's actions until it detects suspicious behavior.

Here's where Smart App Control enters the fray, employing a proactive methodology, operating on the principle of "Guilty until proven innocent." It assesses the application's security by vetting it against Microsoft's Intelligence Security Graph (a cloud-based reputation service). If this test is inconclusive, it attempts to validate the application's digital signature, to ensure its origin from a trusted developer. The application is blocked by Windows Security if it is predicted to be malicious in the first check or unsigned in the second check.

Yesterday, Microsoft published an official blog post detailing its changes to Microsoft Defender for Individuals. The post focused on improving public Wi-Fi security and functionality through its mobile app's VPN (Virtual Private Network) functionality. The "Privacy protection" functionality in Microsoft Defender now reflects whether your Wi-Fi is considered secure and enables a helpful "VPN on" toggle for when you are on public or unsecured Wi-Fi and wish to anonymize your traffic.

For those unfamiliar with VPNs, here's what you need to know. VPNs anonymize your browsing traffic, or at least obfuscate precisely what's happening between your PC, access point, and the Internet before you do whatever identifiable actions you are doing online. Paid VPN plans are a top choice among privacy enthusiasts, but options like the Tor Browser, specific extensions, and/or better browsing habits can also help you stay secure online.

So, what's the catch of the Microsoft Defender VPN functionality? Well, there are a few catches. For one, while Defender itself, with its Privacy protection VPN, is available on Windows, Mac OS, Android, and iOS, it isn't on Linux. The insecure Wi-Fi detection feature also doesn't yet work on Mac OS but does work on the rest of the targeted platforms. The "suspicious Wi-Fi detection" feature is also exclusive to the two mobile platforms. Additionally, only Germans, Canadians, US users, and UK users get access to the VPN functionality— and anyone who does use it long-term will need to pay for a Microsoft 365 subscription.

Regarding what's new, Microsoft announced that Microsoft Defender's VPN features will soon be available in ten additional countries in Europe, Asia, and Latin America. Additionally, the ability to automatically enable a VPN on public (and presumably unsecured) Wi-Fi will be "coming soon" to the Defender app across platforms. At the same time, the enhanced suspicious Wi-Fi detection is also listed as "coming soon" to the desktop versions of the Defender App.

Hopefully, Microsoft can iron out these last few compatibility hiccups to provide a more definitive security solution for its users. For now, a Microsoft 365 subscription will at least earn most Defender users 50 GB a month from Microsoft's VPN server before throttling occurs.

Kaspersky, a Russian cybersecurity firm, ceased its U.S. operations but has automatically replaced its antivirus software on American computers with UltraAV. No warning was given that the switch would occur on the day, reports Bleeping Computer. This decision follows the U.S. government's ban on Kaspersky software updates and sales, which takes effect on September 29, 2024, over national security concerns. 

Earlier this year Kaspersky was added to the U.S. Entity List due to national security concerns and had to halt business in the U.S. In July, Kaspersky began laying off U.S. employees and preparing to close operations. In September the company notified its customers that they would be transitioned to UltraAV, an antivirus from Pango Group. However, the abrupt transition occurred without warning via an automatic update a few days ago.

"Following the recent decision by the U.S. Department of Commerce that prohibits Kaspersky from selling or updating certain antivirus products in the United States, Kaspersky partnered with antivirus provider UltraAV to ensure continued protection for US-based customers that will no longer have access to Kaspersky’s protections," a statement by Kaspersky reads. "Kaspersky and UltraAV worked closely to ensure customers would maintain the standards of security and privacy users have come to expect from their service." 

Many users were surprised to find that Kaspersky software was abruptly removed from their devices and UltraAV installed instead. This occurred through an automatic update on September 19, 2024, and was intended to avoid any disruption in protection. Customers reported confusion and concerns, some even feared that malware had infiltrated their systems due to the unannounced switch. Those previously subscribed to Kaspersky's VPN services also found that UltraVPN was installed, unexpectedly. 

Additionally, some users had difficulty uninstalling UltraAV, which reappeared after rebooting their devices.  

Kaspersky defended its decision, explaining that the transition was made to ensure continued protection for U.S. customers after the company's departure from the market. The company assured users that UltraAV offers a similar set of features to Kaspersky's previous software. Meanwhile, UltraAV claims that its services are even better than Kaspersky's as it offers $1 million identity theft compensation.  

"If you are a paying Kaspersky customer, when the transition is complete UltraAV protection will be active on your device and you will be able to leverage all of the additional premium features," a statement by UltraAV reads. "Your billing schedule with UltraAV will be the same as your Kaspersky account. Annual and monthly billing will remain the same."

Kaspersky Lab, a Russian cybersecurity and antivirus software company, announced it will start shutting down all of its operations in the U.S. on July 20. The departure was inevitable after 12 of the company’s executives were hit with sanctions, and the company’s products were banned from sale in the U.S.

Kaspersky Lab told BleepingComputer of the pending closure and confirmed it would lay off all of its U.S.-based employees. Reportedly, the shutdown affects less than 50 employees in the U.S. The impact on cybersecurity could be much greater since the company’s researchers have been responsible for stopping or slowing countless major security exploits.

The United States government has claimed that Kaspersky’s continued operations in the U.S. posed a significant privacy risk. Since Kaspersky is based in Russia, officials worry the Russian government could exploit the cybersecurity firm to collect and weaponize sensitive U.S. information.

In June, the Department of Commerce’s Bureau of Industry & Security (BIS) issued sanctions on Kaspersky. A Final Determination hearing resulted in Kaspersky being banned from providing any antivirus or cybersecurity solutions to anyone in the United States. Kaspersky’s customers in the U.S. have until September 29, 2024, to find alternative security and antivirus software.

Kaspersky told BleepingComputer that it had “carefully examined and evaluated the impact of the U.S. legal requirements and made this sad and difficult decision as business opportunities in the country are no longer viable.” After all, it’s hard to run a business that provides cybersecurity and antivirus solutions when you’re banned from doing so.

The BIS placed Kaspersky Lab and its U.K. holding company on the U.S. government’s Entity List because of their ties to Russia. This prevented Kaspersky from conducting business in the U.S. At the same time, a dozen members of Kaspersky’s board of executives and leadership were individually sanctioned.

These sanctions froze the executives’ U.S. assets and prevented access to them until the sanctions were lifted. While Kaspersky insisted the ban was based on theoretical concerns rather than evidence of wrongdoing, sources close to the matter have said otherwise. Russian backdoors into Kaspersky’s software are an “open secret,” they said, and a Commerce Department official stated the department believes it is more than just a theoretical threat.

Microsoft Defender, Windows’ built-in antivirus tool, is widely considered robust enough to mean that an average user no longer needs a third-party antivirus or security suite. However, a bug brought to light by Twitter/X user yappy shows that there are times when Microsoft Defender can be extremely overzealous in its attempts to defend your computer.

A false positive can be observed when you type ‘This content is no longer available.’ or ‘This content is no longer available!’ in Notepad and save it as a text file on your PC. When you do so, Microsoft Defender will instantly flag it as a Trojan file and delete it from your system - no matter what file name you use, ostensibly protecting you from a potential 'severe threat.'

Upon first investigation, yappy and some other Tweet/Xers concluded that the cause of the false positive was an SHA-256 collision. However, the astronomical odds against such a clash rung true, as most commenters now agree the headlining text string was used in several previous threats, and thus raises a red flag in the Windows Defender detection engine.

This head-scratching bug isn’t the first time Microsoft has had issues with its Defender antivirus. Microsoft actually broke it in 2020 with a faulty update, while it patched a serious bug in 2019 that prevented the antivirus app from operating properly. But aside from these missteps, we still consider Microsoft Defender as a pretty good antivirus.

Thankfully, this bug isn’t as serious as those issues, as the text line doesn’t pose any actual threat to Windows 11. Furthermore, if you add other text to it (like changing punctuation or adding an extra space at the end), the false detection goes away. However, in the unlikely event that you must have this exact text string saved on a text file on your computer, you need to exclude the folder where you’re saving it from scans, otherwise, it’ll be gone the moment you hit Ctrl + S.

Hopefully, Microsoft can fix this silly bug soon. This isn’t a threat to the security of Windows 11 and we don't think anyone will want to temporarily disable Microsoft Defender and install another antivirus program waiting for a fix. Meanwhile, Kaspersky has recently become even less attractive as an alternative, as Washington has just sanctioned it.

Microsoft Defender is an essential security tool preinstalled on the Windows 11 operating system. The security suite is fully baked into the operating system to protect your system from malware, but not everyone likes it. Would you prefer to install an alternative antivirus/antispyware to kick Microsoft Defender to the curb? We have two options: temporarily disable the real-time scanning component of the security suite or disable the entire suite long-term in favor of a competing app.

Temporarily Disable Microsoft Defender Real-time Antivirus Protection

If you want a relatively easy way to disable Microsoft Defender’s real-time scanning engine, we have you covered with the following steps:

1. Click on the Start menu and search for the Windows Security app.

2. Once in the Windows Security app, click on Virus & threat protection.

3. Select Manage settings under Virus & threat and protection settings.

4. You'll see a button for Real-time protection; turn it off.

5. Turning off Real-time protection will present a red X and a warning message about your computer being vulnerable to attacks.

Remember, this only temporarily disables real-time antivirus protection. Microsoft warns that potentially harmful apps and files downloaded from the Internet are not scanned when real-time protection is disabled. However, scans already scheduled for your system will continue unabated.

Disable Microsoft Defender by Installing Another Antivirus Program

There's another way to disable Microsoft Defender once and for all, and not just the real-time antivirus function. Installing a third-party antivirus security suite will automatically put Microsoft Defender on the back burner.

Let’s use AVG Antivirus Free as an example. It’s a free, no-frills Microsoft Defender alternative that has been around for two decades. Although our example uses AVG Antivirus Free, installing any credible antivirus program will have the same effect in disabling Microsoft Defender.

1. Install your preferred antivirus software (in this case, AVG Antivirus Free). This action will automatically disable Microsoft Defender.

2. Once your software is installed, open the Windows Security app.

You should now see that Windows 11 now recognizes AVG Antivirus (or your preferred antivirus app) protecting your computer.

At this point, your installed antivirus software has complete control over real-time scanning and manual scans of your computer with no intervention from Microsoft Defender. However, if you want increased protection, you can click on Microsoft Defender Antivirus options.

Here, you can turn on Periodic scanning to have the software occasionally scan for threats in the background.

We should caution that, while it is possible to disable Microsoft Defender in varying degrees, it is not advisable (in most instances) to run without real-time protection on an internet-connected computer for an extended period. 

One of the world’s most popular free antivirus applications, Avira, now includes a cryptocurrency mining tool embedded in its software solutions, joining Norton 360 in embedding Ethereum mining code. The module is present in Avira’s entire product stack, from its free antivirus through paid security solutions. Avira also notes that usage of the mining module is completely opt-in. And according to the company, it will only take advantage of unused processing cycles on user machines that satisfy the module’s system requirements. 

Once enabled, the “Avira Crypto” module in Avira’s free antivirus suite connects the user with an Ethereum mining pool, where they can contribute to distributed PoW (Proof of Work) workloads while receiving Ethereum rewards that are proportional to their computing power. The cryptocurrency mining module was first detected through Virus-Total as early as September 2021, after being flagged by other cybersecurity solutions as containing cryptocurrency mining trojans (there’s some measure of irony there). 

The move may seem surprising, but it seems like it’s part of an additional monetization effort from Avira and Norton360 parent-company: Tempe, Arizona-based NortonLifeLock Inc. The company announced the acquisition of Avira for $360 million back in January 2021, creating an $8-billion (at the time) cybersecurity juggernaut and bringing Avira’s users into its ecosystem. In August 2021, NortonLifeLock announced it had reached yet another acquisition deal with wildly popular cybersecurity software company Avast.

That particular business deal, valued between $8.1 billion and $8.6 billion – and the third most expensive acquisition in cybersecurity history at the time – added an extremely significant 435 million users to NortonLifeLock. The company has made it clear that these acquisitions pave the way towards reaching a worldwide install base of 500 million users for its cybersecurity products. But considering this cryptocurrency mining integration, it seems NortonLifeLock is also looking to achieve a 500 million cryptocurrency miner install figure. Both Avira and Norton 360 apply a 15% fee on all Ethereum rewards generated by their respective “Avira Crypto” and “Norton Crypto” modules.

The inclusion of mining software in cybersecurity solutions is a particularly complex affair, considering how cryptocurrencies demand specific cybersecurity measures from their users. Avira does provide a FAQ on the matter covering the most basic elements of crypto and blockchain technology, but mostly it describes and asserts limited liability, as well as warning users that their mining efforts may result in utility costs that surpass the possible Ethereum earnings. And right now is a particularly bad moment for any such efforts, considering how the cryptocurrency market has been bleeding value of late. Of course, Avira and Norton’s own 15% share of the profits will always be there, so long as there are profits to be had. And since the company is using users’ hardware and utilities, its profits happen irrespective of mining efficiency.

If you’re wondering why an “Avast Mining” module still isn’t present on the Avast antivirus suite (and its much more significant 435 million user install base), you can count timing as one of the reasons: The deal isn't expected to be complete until mid-2022. The fact that NortonLifeLock is keeping a clear branding scheme with its “antivirus + Crypto” naming does seem to point toward a unified cryptocurrency mining vision for its cybersecurity products. That's one way to fill the company’s coffers after its recent buying spree. Only time will tell exactly how much this strategy pays off.

NortonLifeLock announced yesterday that it’s adding Ethereum mining to its Norton 360 antivirus software with an upcoming feature, Norton Crypto, that “select Norton 360 customers in Norton’s early adopter program” are invited to test. 

Let’s make this clear from the start: Enthusiasts will probably be better off learning how to mine Ethereum themselves instead of relying on Norton Crypto. The feature is likely intended for the kind of person who’s never heard of a hash rate, shopped for the best mining GPU, or wondered how to optimize their GPU for Ethereum mining. It’s worth considering how Norton Crypto is presented to those people.

“For years, many coin miners have had to take risks in their quest for cryptocurrency, disabling their security in order to run coin mining and allowing unvetted code on their machines that could be skimming from their earnings or even planting ransomware,” the company said in a press release. “Earnings are commonly stored directly on miners’ hard drives, where their digital wallet could be lost should it fail.”

Naturally, Norton positions Norton Crypto—and the accompanying Norton Crypto Wallet—as the solution to those concerns. The former is a mining tool built into antivirus software people already trust; the latter is a cloud-based solution to which people can transfer their earnings ”so it cannot be lost due to hard drive failure.” It’s not hard to see how the feature could appeal to the (barely) crypto curious.

Unfortunately we don’t have many other details about the feature. NortonLifeLock said Norton Crypto “is expected to become available to all Norton 360 customers in the coming weeks.” But at the time of writing, the company hasn’t updated its website to provide more information about how it’s monetizing the feature, how it’s securing the cloud-based wallet, or how the underlying mining process operates.

Those are important questions to answer. It’s already hard to mine Ethereum at a profit even on dedicated hardware; doing so on a basic system through a feature built into antivirus software would probably be even more difficult. Clearly explaining the increased energy costs, potential impact on the system’s performance, and the cryptocurrency market volatility probably wouldn’t be trivial either.

NortonLifeLock might also have to re-teach the concept of cryptocurrency to some of its customers. Right now, there are 10 results on the Norton website for “crypto.” Three are basic explanations of cybersecurity, cryptocurrency, and ransomware; three are about specific vulnerabilities, a malvertising campaign, or Cryptolocker; three are basic support articles; one is just a link to the Emerging Threats page.

Most of those results (and the pages they lead to) don’t exactly portray cryptocurrency in a positive light. That’s fair—cryptojacking is a serious problem. But it’s not hard to imagine there will be a certain amount of cognitive dissonance caused when people load the antivirus app that’s been warning them about malicious crypto mining for years suddenly offers to help them mine crypto.

We should know more about how people will react to Norton Crypto when the feature reaches all Norton 360 customers in the coming weeks, assuming everything goes as scheduled and as the first testers gain access to the feature.

We’re now well into the third month of the COVID-19 pandemic, with no clear end in sight. Isolation is starting to take its toll, as more and more businesses shift to remote work and more and more governments issue mandatory quarantine and shelter-in-place notices. Unsurprisingly, this atmosphere of anxiety and uncertainty represents a perfect target for cybercriminals.

Thus far, hackers have targeted interactive Coronavirus maps, registered numerous false domains, and significantly ramped up their phishing attempts. Awareness of these attacks is an important first step. Mindfulness of the tactics criminals are using to play on everyone’s fear goes a long way towards seeing through them. 

Conscientiousness only goes so far, though. Even if you know about what hackers are doing, everyone makes mistakes — and it only takes one slip-up for an infection. That’s why, in addition to staying savvy on the web, it’s also important that you install the right security software.

To that end, you should check out online marketplace BZfuture. They’re currently offering huge deals on some of the leading antivirus and security software on the market.  For a limited time, you can get the following at half-price from anywhere in the world - better yet, each deal comes with a free copy of Windows 10 Professional.

• McAfee Antivirus (1 Year, 1 PC): $16
• Kaspersky Internet Security (6 Months, 1 PC): $16
• Kaspersky Antivirus (1 Year, 1 PC): $22
• Avira Antivirus Pro (1 Year, 1 PC): $18
• Bitdefender Antivirus Plus (1 Year, 1 PC): $24

All of the above software also comes with a free Windows 10 Professional Key, complete with BitLocker file encryption, remote desktop software, virtualization, and greater overall control of your PC. Speaking of control antivirus software isn’t the only thing that’s on offer, either. BZfuture is also offering a huge discount on AOMEI Partition Assistant Professional Edition 8.6, currently retailing at $20.32 with a free copy of Windows 10 Professional.

With Partition Assistant, you can easily create, resize, merge, move, and split partitions without losing or corrupting data. This allows you to readily maximize disk space, with added features like migration between operating systems. Combined with Windows 10 Professional, this enables better data management than ever before, right at the time when we all need it most. 

For each of the above deals, after payment, you’ll be provided with two keys: one for your selected antivirus software, and the other for a copy of Windows 10 Professional. If you already have a copy of Windows 10 Home, you can use the key to upgrade. Simply open your System Settings, Select About System, then click on Change Product Key or Update Windows Version. BZFuture also provides support on its website, so if you’ve any questions, you can contact them via chat or email service@bzfuture.com.

Particularly in light of current events, mindfulness on the web is absolutely essential. In part, that’s maintaining awareness of the common tactics criminals are using to target people online. But it’s also important that you install the right software to keep yourself safe, secure, and in control. 

According to research by Sophos, a leading software security firm, a ransomware called "RobbinHood" has been making use of legitimate, but vulnerable, Gigabyte drivers to infect computer systems and take them over. 

The attack works on Windows 7 and newer operating systems (OSes). Gigabyte had previously dismissed the claims that its driver was vulnerable to the flaw that the ransomware group is now exploiting, according to Sophos.

Gigabyte shares part of the blame for initially dismissing the vulnerability in 2018, when security researchers first reported it to the company. The public eventually put enough pressure on Gigabyte that it acknowledged the flaw. 

However, instead of releasing a patch to fix the vulnerability for its older motherboards, the company discontinued support for that driver. This poor judgement on Gigatebyte’s part has now allowed attackers to weaponize its unpatched driver. 

Another party responsible, Sophos said, is Verisign. Two years after Gigabyte discontinued its driver, it's still “trusted” by the Windows OS and many antivirus programs by default due to Verisign  failing to revoke its signing certificate. This has allowed attackers to take advantage of the trusted driver to install another unsigned driver on the victims' machines. 

After, the attackers would use this new driver first patch the Windows kernel in-memory and kill antivirus programs and other endpoint security solutions that would prevent the ransomware from taking over the machine.

One-of-a-Kind Ransomware

Sophos researchers said that even though they’ve seen other ransomware try to kill antivirus programs before, they’ve never seen one where the ransomware uses a trusted third-party driver to achieve that. 

Most security solutions have some kind of “trusted programs” list enabled by default on all installations. This is a compromise security companies have made in order to end a large amount of false positives and avoid having too many users block programs because they didn’t understand what the antivirus was asking them to do.

However, chances are that as other avenues to exploit the Windows OS close, malware makers will start to explore additional ways to use that trusted programs list in their favor. If they can trick antivirus programs to believe that their malware is one of the trusted programs in that list, then they later can get almost free reign on a user’s machine.Mitigation Against This Attack

Mitigation

As the RobbinHood ransomware has shown us, even if your OS is fully patched, a hacker can still leverage other techniques to bring vulnerabilities to your computer. 

Sophos recommends not relying on a single program to keep you safe, while also adopting other security best practice,  such as using OS accounts with limited access rights by default, making regular backups, using multi-factor authentication. 

That didn't take long. Just a few days after Motherboard and PCMag revealed more details about how Avast sells user data via its subsidiary, Jumpshot, Avast announced that it's decided to "wind down" the subsidiary "with immediate effect."

We noted earlier this week that Avast is most well-known for its free-to-use antivirus solution. The reports from Motherboard and PCMag revealed just how much information the company gathered about users who opted into sharing their data.

Avast CEO Ondrej Vlcek said in today's announcement that his company will "terminate the Jumpshot data collection" in addition to shuttering the subsidiary. To hear him tell it, this was the plan all along: 

"When I took on the role as CEO of Avast seven months ago, I spent a lot of time re-evaluating every portion of our business. During this process, I came to the conclusion that the data collection business is not in line with our privacy priorities as a company in 2020 and beyond," Vlcek said. "It is key to me that Avast’s sole purpose is to make the world a safer place, and I knew that ultimately, everything in the company would have to become aligned with our North Star."

Despite the controversy from the recent reports, Avast disclosed the fact that it sells user data via Jumpshot back in 2015, and its antivirus users have to opt in to sharing their information with the subsidiary during install.

Motherboard said the data sold by Jumpshot included "Google searches, lookups of locations and GPS coordinates on Google Maps, people visiting companies' LinkedIn pages, particular YouTube videos and people visiting porn websites."

That information was said to be de-personalized, but experts feared that companies might be able to de-anonymize (re-personalize?) the information by comparing it to their own data sets, which could undermine the privacy of Avast's users as a result.

Now, they apparently won't have to worry about that. 

Vlcek said the decision will "regrettably impact hundreds of loyal Jumpshot employees and dozens of its customers." It's not clear if Jumpshot's employees will be reassigned within Avast or if they'll be laid off as a result of the controversy.

According an AV-Test report shared Tuesday, most antivirus vendors have not announced an official end-date for their support for Windows 7, which hit end of life (EoL) on January 14. However, many will support the operating system (OS) for at least another two years.

Google was one of the first to announce that its Chrome browser will support Windows 7 at least until July 2021. Now antivirus vendors are promising even longer support timeframes with no official end date in sight. That means that two years could very well turn into three or four, depending how popular Windows 7 remains.

It’s not too out of the ordinary for antivirus vendors to support a dated OS for this long because the more time passes, the more vulnerable Windows 7 will be. 

If you want to find out how long your antivirus will support Windows 7, see the full list here.

Many Users Are Still on Windows 7

Businesses and personal users, (including overclockers) that have stuck to using Windows 7 make up a quarter of the total Windows installed base, even after Microsoft announced that it officially ended support for the OS. The Windows XP situation seems to be repeating itself. Back when Microsoft officially ended support for that OS, about a quarter of Windows users kept the OS for a few more years. 

Microsoft is also going to continue to support service systems that use Windows 7 until 2023. 

That said, it’s possible Microsoft will still provide an update to Windows 7 if there are serious vulnerabilities. It has already done this for Windows 7 and also did so with Windows XP. 

Should You Use Windows 7 for Another Two Years?

Windows 10 has been long criticized for some of its UX issues and the seemingly bad quality and assurance that ends in a stream of bugs accompanying major updates. Another issue has been Windows 10's pervasive tracking, including some enabled by default and others you can't even disable. As such, it's understandable why some people may not be in a hurry to switch to Microsoft's latest OS. 

However, unless you've implemented a bunch of additional protections on Windows 7 that you're confident can generally keep you just as safe as software patches would (browsing in a Linux virtual machine, for instance), then relying on antivirus software won't be enough.

Antivirus programs will mainly protect you against malware that's already been in the wild for some time and discovered by antivirus companies. However, even then malicious actors could exploit OS/kernel-level bugs to cripple antivirus protection. 

Therefore, most people should consider switching either to the latest Windows 10, which you can still get for free by upgrading from a Windows 7 license, or switch to a different OS from another vendor (Linux distros, macOS, Chrome OS, et cetera). 

Avast is well-known for its free-to-use antivirus software. Yesterday, reports from Motherboard and PCMag provided more details on something the vendor is less known for: selling browsing data of its antivirus' users via a subsidiary called Jumpshot.

The reports indicated that Jumpshot sold information about Avast users to a number of companies, including IBM, Intuit, L'Oréal and Home Depot; however, several of those companies, along with others named in documents shared with Motherboard and PCMag, denied working with Jumpshot. 

According to Motherboard, the shared information included "Google searches, lookups of locations and GPS coordinates on Google Maps, people visiting companies' LinkedIn pages, particular YouTube videos and people visiting porn websites."

"It is possible to determine from the collected data what date and time the anonymized user visited YouPorn and PornHub, and in some cases what search term they entered into the porn site and which specific video they watched," Motherboard said. 

The information was said to have been stripped of personally identifiable information, such as users' names, but experts fear certain activities could be de-anonymized by combining the data sold by Jumpshot with other datasets. This could violate the privacy of people who might not have realized their data was being sold.

De-anonymizing that data would be difficult, experts said, but not impossible. Jumpshot is said to offer multiple feeds, with an "All Clicks Feed" offering detailed information about the websites Avast users visited, when they visited them and on what device they viewed them. Companies could potentially use these detailed records alongside their own datasets to identify supposedly anonymous individuals.

However, in a statement sent to Tom's Hardware, an Avast spokesperson insisted that Jumpshot doesn't gather "personal identification information, including name, email address or contact details."

"Users have always had the ability to opt out of sharing data with Jumpshot. As of July 2019, we had already begun implementing an explicit opt-in choice for all new downloads of our AV, and we are now also prompting our existing free users to make an opt-in or opt-out choice, a process which will be completed in February 2020," the spokesperson the spokesperson continued.

"We have a long track record of protecting users’ devices and data against malware, and we understand and take seriously the responsibility to balance user privacy with the necessary use of data for our core security products."

This data collection wasn't exactly hidden from Avast users, however, because the company disclosed the fact that its Jumpshot subsidiary uses some of its user data in a 2015 blog post.  

The Avast rep also told us that as of December, Avast is "compliant with browser extension requirements for our online security extensions" and doesn't use any data from browser extensions "for any other purpose than the core security engine, including sharing with our subsidiary Jumpshot."

Yet, the practice hasn't been perfectly transparent. The amount of information gathered by Avast for Jumpshot was previously unknown, for example, as was the list of companies looking to purchase that much data about consumers.

Avast did start offering more information about the data it collects when people install its antivirus solution recently, though. A dialogue box currently says that "If you allow it, we'll provide our subsidiary Jumpshot Inc. with a stripped and de-identified data set derived from your browsing history for the purposes of enabling Jumpshot to analyze markets and business trends and gather other valuable insights."

But it's not hard to imagine people agreeing to that request without understanding what it means. Who hasn't clicked "OK" or "Yes" in response to a dialogue box they haven't read or don't fully understand? We suspect many people don't correlate "a stripped and de-identified data set derived from your browsing history" with the "search term they entered into the porn site and which specific video they watched."

And this opt-in data sharing isn't the only way Avast provided information to Jumpshot. The company saw criticism in October 2019 for collecting user data via browser extensions; those extensions were removed from the add-on stores operated by Google, Mozilla and Opera for their respective browsers in response.

More than 435 million people a month reportedly use Avast's antivirus software, and Jumpshot claims to have access to information from 100 million devices, according to Motherboard. 

The problem here wasn't the lack of disclosure on Avast's parts, with the exception of the data collected by its browser extensions, because it did say in 2015 that it would collect that data. It also informed users their information could be collected, and gave them a chance to opt out. The problem is that many people looking for a free antivirus solution probably don't understand exactly what they're sharing. 

This criticism applies to many companies. People have become increasingly aware of the tech industry's reliance on near-constant surveillance of their users, but it's still a subject about which few people are adequately educated. Avast isn't much different from many other companies--but does that mean the status quo is acceptable? Or that a blog post from half a decade ago and some corporate speak is enough info?

That's something people will have to decide for themselves. In the meantime, Avast users should double-check their settings in the interim.

Microsoft patched a serious flaw in the Windows Defender security utility today. The issue resulted in certain malware scans failing after just a few minutes, per ZDNet, which found reports of this issue across social platforms like Reddit as well as tech support websites. Those failed scans could have left Windows users vulnerable to attack even though the operating system has a built-in antivirus solution that's supposed to keep them safe.

The issue followed an all-too-familiar pattern: there was a System File Checker bug in Windows that Microsoft attempted to fix with the release of Windows Defender version 4.18.1908.7 earlier this week. Instead of fixing the problem, however, the update reportedly messed up the process that allows Windows to scan files. An update released to fix one problem accidentally resulted in critical parts of Windows Defender malfunctioning.

This has become a trend with Microsoft. An update meant to improve wireless connectivity on Surface devices actually prevented them from connecting to some networks. A fix to a "SearchUI.exe" bug that resulted in high CPU usage broke Windows Desktop Search, and the update meant to fix search failed spectacularly, with users reporting that the update led to further issues with core parts of the Windows 10 experience such as Action Center.

At this point we're hoping this problem is limited to the Windows team, because if it extends to any of Microsoft's on-campus medical staff, employees might want to keep any health problems to themselves. Sore elbow? Maybe a broken arm will help. Runny nose? Well, noses are overrated, right? At least then Windows systems wouldn't be the only things exposed to infection because someone tried to keep up with important updates.

The good news is that Microsoft said it fixed this issue with the Security Intelligence Update for Windows Defender Antivirus – KB2267602 (Version 1.301.1684.0) release from this morning. But to be honest, by now we're just waiting for someone else to find out that something worse has happened as a result of this update. Things like this can only happen so many times before Windows users start to seriously doubt any software updates.

Kaspersky Lab, with over two decades of experience, is a household name in cybersecurity. Its current anti-malware suite, Kaspersky Anti-Virus 2019 brings plenty of features for keeping users safe while on the Internet.

The key to Kaspersky Anti-Virus is its intelligent behavioral model, which uses machine learning to identify malware through its behavior without the requirement of a prewritten virus signature. This suite assimilates nicely with Windows 10, working harmoniously with the operating system’s (OS’) included security tools to provide additional protection against the full spectrum of malware threats. Recently added detection capabilities also shut down outgoing requests to malicious servers.

Price

Kaspersky Anti-Virus is priced to be competitive, starting at $29.99 (£23) for a 3 PC, 1-year license. You can lower the annual price per device by adding PCs and extending the subscription to up to three years.

Kaspersky’s pricing scheme differs from competitors like ESET NOD32 or Norton AntiVirus with starting prices ($39.99) for protecting just 1 PC.

To protect PC, Mac and mobile device, Kaspersky offers two pricer options:

• Kaspersky Internet Security: starts at $39.99 (3 devices, 1 year)
• Kaspersky Total Security: starts at $49.99 (5 devices, 1 year, 2 user accounts)

All Kaspersky consumer products offer a full 30-day trial. It is a 100% free download, and you can try it on your PC without entering payment information.

Setup and User Interface

The Kaspersky Anti-Virus installation process is easy, streamlined and quick. To start, sign up for a free trial via Kaspersky’s website, where you’ll get a small download file. After accepting the license agreement, the installation package automatically downloads. We were able to complete installation without a license or putting in an email address. We did use the “Activate Trial License” link to complete setup.

However, there was an additional step. Kapersky’s dashboard next updated the signatures and program files. Most other antivirus software automatically does this quietly in the background during the installation. On the other hand, being able to manage the update will be an asset for some users.

Kaspersky Anti-Virus took up about 275MB of space on our hard drive, with just two core processes, requiring a comparatively low 90MB RAM, running in the background. It’s safe to say that this program is light on system resources.

Kaspersky Anti-Virus uses a simple interface to disclose the current protection status through a clean visual display with green indicators. Four main buttons cover all the essential tasks: launching a scan, updating a database, viewing a report and accessing the on-screen keyboard.

Antivirus Scans

The Scan panel is used to initiate a quick or full system scan and can completely disinfect the entire storage drive or hone in on specific files and folders. The downside is that you have to do more navigation than is required of competitors. For example, three clicks are inputted into the console to set off a Quick Scan--not so quick, ultimately.

Our testing confirmed that this version of antivirus software is Kaspersky’s fastest to date. The Quick and Full scans both finished faster than the average for an antivirus suite when we benchmarked the software on our review system.

We appreciate the simple scheduler that runs various scan types on an automated basis, which specifies scans for a daily, weekly or monthly interval. The custom configuration option is useful for scheduling a scan on the next day when the system is powered off, which will have less impact on your PC’s performance, and to limit scans to a locked or sleeping computer.

Kaspersky Anti-Virus has choices for finely tuning each scan type, down to the details of the zone to be scrubbed, the type of file to be examined, a selection of the detection engine and the plan for detected threats (disinfecting the file, deleting it, or asking what’s next). The options are aplenty. You can speed up Quick Scans by configuring Kaspersky to skip old files, only sanitize new and modified files. Or maybe you only want to use Full System Scans to scrub specific network folders. Just remember that granular control does have its compromises, as speeding up scans can reduce your level of malware protection.

The Vulnerability Scan gives an assessment of how secure your system is, looking for expired security patches, vulnerable Windows settings and more. When we ran the scan on our test PC, we were informed that autorun for removable drives is enabled by default and were able to address it with a few clicks. This was a helpful alert, considering that having this feature enabled makes the system vulnerable to USB key-based malware.

Even with all the different scan types, we still yearn for the ability to implement true custom scan types. The option to create an 'Ultra Quick Scan' with just a few clicks would be welcome and also retain the option for the original Quick Scan. Major competitors, including Avast and Avira, offer these options to appease their expert users, who many find Kaspersky’s limitation of existing scan types only too, well, limiting.

Antivirus Testing and Performance

We pit Kaspersky Anti-Virus against our homebrew ransomware simulator. Although it is fairly simple, there is no chance of it being a known threat to Kaspersky, which means the software would need to identify it from its behavior, not from virus signatures.

Our ransomware got running, and the Kaspersky System Watcher module monitored the simulated ransomware’s behavior. First, there was a quick notification that this ransomware indeed was a threat, before the software neutralized the process. Next, the antivirus deleted the ransomware file from the PC. The ransomware did manage to encrypt a handful of document files before Kaspersky could neutralize it. But this turned out to be no problem, as Kaspersky Anti-Virus easily decrypted and restored the original files, so nothing was lost. An impressive performance, this validates that Kaspersky safeguards against even yet-to-be-discovered threats with ease.

An antivirus program has to make sure that it is safe from malware in general, so we put it through some simple tests that attempted a modification or deletion of the Kaspersky files. After this testing, we can conclude that this package can certainly protect itself, with none of our attacks causing any harm to the antivirus program.

Other Security Features

Kaspersky Anti-Virus’ most critical element is the core antivirus engine, which blocks malware prior to it threatening your PC. But there’s also the System Watcher, which uses behavior monitoring technology to find undiscovered threats. It has multiple protection layers, which work on a full array of threats, from network attacks, to malicious email objects and phishing attacks.

Kaspersky Anti-Virus also has anti-adware capability. Plus, there’s Kaspersky Secure Connection, a rather rudimentary VPN (from the folks at Hotspot Shield). Sure, we can find a use for a VPN that doesn’t require registration, but its low 200BMB daily data allotment makes  it less than useful for daily usage. The option to upgrade it to unlimited traffic for $4.99 (£3.80) monthly isn’t a huge bargain, since there are a lot of other VPNs (particularly with long-term subscriptions) available for that price or less.

Kaspersky Anti-Virus has a few more tricks up its sleeve. For example, there is the simple on-screen keyboard for entering protected logins of user credentials, account numbers and other private details that demand higher security. We ran it against a number of commercial keylogger software solutions and happily report that none captured our keystrokes.

The Windows Troubleshooting Wizard allows you to search your Windows OS for any damage from malware or revert changes applied to earlier issues. While potentially useful, we don’t know the true breadth of issues examined. With our review PC, the Windows Troubleshooting Wizard did not encounter any new issues, (except for the aforementioned autorun that we already knew about).

Another overpromise is the Browser Configuration Wizard, as this module confines itself to configuring a single browser, Microsoft Edge, not even the browser of choice for many users. At least this browser engine gets utilized by some other applications, so even for alternative browser aficionados, addressing these Edge issues can help secure their system.

The Privacy Cleaner searches for and deletes Windows and activity records from your browsing history, along with cookie lists of Recent Documents, recently run programs, recent folders used and more. While nothing is seriously wrong with this feature, like others in this suite, it’s simply not exceptional, and there is no shortage of dedicated freeware software available that is just as functional.

Another marginal bonus element is Kaspersky Rescue Disk. This bootable environment detects and deletes deeply embedded threats, which can corrupt Windows and prevent booting. While a welcome useful feature, experts will note that this feature is entirely free for all to download from the Kaspersky website; Kaspersky Anti-Virus is merely providing the download link.

Overall, Kaspersky is weak when it comes to bonus features and lags the competition. By way of comparison, Avast Free Antivirus includes a Wi-Fi Inspector that locates wireless vulnerabilities, weak passwords and needed software patches, and Bitdefender Antivirus Plus has a password manager, online banking protection and bootable rescue mode. Most users do not choose an antivirus program based upon bonus elements, but that being said, we would encourage Kaspersky to include additional features in a future edition.

Bottom Line

Kaspersky Anti-Virus 2019 may be missing the full set of bonus features of its competition, but this you may be able to overlook this for a software that excels at accurate anti-malware protection.

Power users will lament the lack of a customizable scan. If that’s important to you, you may want to consider other antivirus solutions, like ESET NOD32 or Norton AntiVirus.

But with its reliable ransomware and general malware protection, coverage of 3 PCs for less than what others change to protect one PC and a free trial that doesn’t require entering your contact info, Kaspersky Anti-Virus is a safe bet.

Image Credits: Kaspersky

MORE: All Security Reviews

MORE: All Security Content

Performance issues, privacy concerns and other problems make it harder than ever to recommend third-party antivirus solutions on Windows. Now it's about to become even more difficult: TechSpot reported that AV-Test, an independent organization that evaluates security products, gave Windows Defender perfect scores across its three evaluation categories after testing 20 antivirus products made for Windows 10 throughout May and June.

AV-Test rated each security offering based on its protection, performance and usability. The highest possible score in each category was six (the organization's use of half-point values results in a 12-point scale). Windows Defender 4.18, F-Secure SAFE 17, Kaspersky Internet Security 19 and Norton Security 22.17 were the only services to receive perfect scores in all three categories. Many others stumbled in several important areas.

This doesn't mean systems running these solutions are impervious to attack. That level of perfection--despite what some may claim--isn't feasible. Instead, these perfect scores means the offerings defended against known threats with a minimal impact on performance and without undue frustration. (More information about how AV-Test evaluates protection, performance and usability is on its website.) Nothing's truly perfect.

These findings show that Windows Defender is just as good as leading third-party antivirus solutions. It's almost enough to make us feel bad for these other companies; it's hard to compete with a well-performing solution that comes bundled with Windows 10 and is made by Microsoft. Just ask Netscape. The main difference is that people can actually benefit from Microsoft's efforts rather than suffering because of its monopolistic impulses.

Antivirus solutions can sometimes create more problems than they solve. Installing them gives another company nearly complete access to a system, and that access can be abused, as "cleaner" utilities have demonstrated. Antivirus solutions can also have their own vulnerabilities for attackers to exploit. Many also prey on non-savvy users to push other services, too, or constantly attempt to get the user's attention for practically no reason.

Windows Defender is supposed to--and according to AV-Test's findings actually does--offer many of the benefits of third-party antivirus solutions without as many of the drawbacks. Microsoft went a bit too far to push Windows Defender a few years ago, which is why it ultimately capitulated to Kaspersky's complaints about anti-competitive practices, but it's hard to argue against good cyber security

Like we said: Windows Defender isn't perfect. It has its own vulnerabilities, and we're sure that some Windows 10 users have been annoyed by the utility, too. But at least people who don't want or can't afford other antivirus solutions have a built-in utility that bests other free options.

Norton AntiVirus has been around since 1991, making it one of the oldest antivirus software solutions.

For this review, we used Norton AntiVirus Basic. However, Norton has since discontinued Basic and replaced it with Norton Antivirus Plus. The two are virtually the same with the same core security features, such as an underlying malware engine and associated services. However, Plus comes with bonus features in 2GB of cloud backup, a web management portal and a two-way firewall.

Norton AntiVirus users also get threat detection of previously identified malware, intelligent behavior monitoring, a file reputation service that spots new hazards and powerful anti-phishing technology. It also includes Norton Identity Safe, which is a password manager but has less features than some competitors.

There are a lot of features, but we found some flaws in the software’s ability to detect new ransomware threats.

Price

The initial annual subscription costs $39.99 for a one-computer, one-year license, with renewals costing $59.99 (about £45) per subsequent year.

First-year rates are equal to Bitdefender but pricier than other competitors. Plus some alternatives offer multiple devices and multi-year license options. For example, Bitdefender offers a three-device, three-year license for $83.99 total. Norton falls short by not offering discounts for additional devices.

Unfortunately, there’s no free trial for Norton AntiVirus. A Norton rep told us there is a 60-day money-back guarantee. However, you’ll still have to pay upfront and having to request the refund is less preferred than a simpler free trial offer.

If you’re willing to pay more, note Norton also offers other antivirus packages:
●    Norton 360 Standard: $8/month, $80/year, one device
●    Norton 360 Deluxe: $10/month, $100/yearr, five devices
●    Norton 360 with LifeLock Select: $15/month, $150/year, five devices
●    Norton 360 with LifeLock Advantage: $25/month, $250/year, 10 devices
●    Norton 360 with LifeLock Ultimate Plus: $35/month, $350/year, unlimited devices

Setup and User Interface

The install process is really easy. However, during our setup process, the software identified another antivirus software which was already installed, Bitdefender, and asked to uninstall it. Although, there was an option to keep it, which we appreciate. We also like that we were warned about a potential issue, and that the user gets to be the final arbitrator of which software goes on their system.

During setup, Norton offers to install some browser extensions. One is Norton Safe Web, which warns users of dangerous websites. The other extension, Norton Identity Safe, gives the functions of a password manager. We consider them both valuable extras, but such software can be found as freeware, so Norton is only adding minimal value.

With the suite fully installed, it occupied 1.6GB of disk space, more than many competitors. Thankfully, with the larger C: drives these days, this shouldn’t be an issue. And Norton did not negatively impact our system resources otherwise. Plus, this software comes with 2GB of free online storage; although that is a very small amount of space.

Examining our test PC’s background processes we found only three, including the Chrome extension host, consuming less than 50MB of RAM, and they ran perfectly fine with no system slow downs.

Norton AntiVirus offers plenty of options and controls. The complete details of your PC’s protection status are cleanly displayed, which includes the timing for your last update and scan with buttons that get grouped into functional groups, including Security, Online Safety and Backup. Clicking on the buttons displays additional options, with total control of all the antivirus settings.

Antivirus Scans

We found Norton’s scan tool simultaneously comprehensive and easy to use. Checking your system is as easy as clicking Security -> Scans, to start a scan immediately. There’s a choice of available modes: Quick or Full. plus a Custom Scan option to focus the scan on specific drives, folders or files to clear out malware.

Norton missed the mark by lacking options for lower level scans, like Avast or Avira. These competing programs offer more than just an archives scan, also allowing the user to specify the types of archives and the depth of nesting to support them (i.e., how many open archives). Still, the average user will be okay with what Norton offers.

For example, you can create a custom scan, such as one that checks D:Files and E:More and skip certain scan types, like rootkits or tracking cookies, to save time. Running can be automated with specific parameters, like when the system is idle and on AC power, for example.
You can also control what happens upon scan completion, including turning off the PC or putting it into sleep mode. While power users may find additional options elsewhere, mainstream users will be able to easily comprehend and use these custom features.

Performance-wise, scans use multiple CPU threads; however Norton is not overly grabby of system resources and will give back those threads when needed for another demanding application to optimize system performance.

Antivirus Testing and Performance

Overall, Norton’s speeds were quite excellent. It also detected all of our test threats, without any false alarms -- a powerful combination for an antivirus software package.

Our own custom ransomware-like program works through a tree of test folders, opening and encrypting common images, videos and other documents. Since we created it and it’s a novel threat, Norton has not encountered it before, making it an excellent test of the software’s ability to detect and block ransomware by behavior only and without relying on the database of virus signatures for malware identification.

Norton fizzled when it came to handling our custom ransomware. With the executable test, the ransomware rapidly ground to a stop, which seemed encouraging. However, as we delved deeper, we found that the ransomware had encrypted some files. We were even more frustrated when we figured out that Norton provided neither an alert nor a pathway to recover the files.

We tempted fate and reran our custom ransomware. That resulted in identical performance, with the encryption of a few files before the ransomware went away with zero warnings.

After the third time running our ransomware, Norton shut it down and displayed an alert with information that a threat was neutralized.

On one hand, Norton detected and blocked the solitary ransomware. But on the other hand, this occurred with no warning, and there was potential for data loss with the time that elapsed before the detection and deletion of our ransomware. On our PC, the ransomware we ran successfully encrypted 454 files before Norton neutralized it. Competitor Kaspersky showed better performance, stopping our ransomware after the encryption of a handful of files and recovering the originals without loss of any data.

With testing finished, we assessed Norton’s impact on our system’s performance, with quite favorable results. Looking at the 2018 Consumer Security Products Performance benchmarks with PassMark Software, Norton’s impact on system performance was the lowest among the 15 contenders and performed superior to the minimal-impact Windows Defender. Therefore, while performance of a given software on any PC can be difficult to predict, Norton runs better than most, making this a strong contender for an older system.

Other Security Features

Norton Antivirus also includes the Norton Power Eraser feature. It’s an effective tool for more complicated problems that would elude a standard scan. The algorithm dives deep to seek out stealthier threats.

If you’re unsure of where to look to locate a possible threat, there’s Norton Insight, a tool that scans processes to quickly highlight any possible malware, at least worth a closer look.

The browser extension protection from malware is more clunky compared to the sleek software solution. However, Norton still excels at URL blocking, making this extension well worth installation if your browser doesn’t don’t already have this type of software.

Additionally, you’ll find bonus tools that are useful for junk files deletion, hard drive defragging and startup program management. These programs are hardly an afterthought and can go toe-to toe with their competitors. For example, the Startup Manager can not only list the startup programs, but also display the number of other Norton users using them. Furthermore, it allows the user to specify a delay in startup to smooth out the boot process and also gives the option to turn them off. Still, power users will point out that freeware tools, including CCleaner, provide plenty of PC maintenance functionality.

Bottom Line

Norton AntiVirus has inherent advantages, such as being accurate, low on system resources, quick and flexible.

However, alternative antivirus solutions Bitdefender and Kaspersky demonstrated better performance on the critical tasks of ransomware and file recovery.

But if you’re looking for an antivirus software with minimal impact on your PC, Norton still has quite a high virus detection rate in general.

Image Credits: Norton

MORE: All Security Reviews

MORE: All Security Content

Skylight Cyber researchers from Australia were able to show the first universal method to trick an “artificial intelligence-based antivirus” into thinking that malware is non-harmful software and let it run on supposedly secured machines. 

The AI antivirus in question is called CylancePROTECT, which BlackBerry purchased last year with plans to integrate Cylance’s AI antivirus technology with its Spark communications platform for the Internet of Things (IoT). The recent discovery points to a potential roadbump in Blackberry's pivot from smartphones to IoT security. 

Creating Universal Bypasses for AI Antivirus

The Skylight researchers said that by analyzing Cylance’s engine and neural net model, they were able to see that the AI antivirus made heavy use of string analysis and had a bias for a particular game. 

This allowed the security researchers to use this bias against the antivirus -- they appended a selected list of strings to any malicious file that would normally be detected and avoided detection. They noted that this method worked for 100% of the top 10 malware (for May 2019) and for 90% of the larger sample of 384 malware. 

Malicious hackers create new malware based on code from older malware that is still able to bypass modern antiviruses all the time. However, that requires a significant amount of work for every new piece of malware. The difference here is that by discovering the AI antivirus’ weakness, the bad actors can easily torpedo machines protected by such antivirus with all sorts of slightly modified malware. 

How AI Can Easily Be Fooled

With a single piece of research, the Skylight security experts were able to show just how catastrophically vulnerable AI-based antivirus tools like CylancePROTECT can be before they even had a chance to get popular the cybersecurity industry. 

The researchers offered an easy-to-understand analogy for how AI-based antivirus solutions can be so easy to trick. If the AI would be trained to learn the difference between birds and humans, it would eventually learn that one of the primary differences between a bird and a human is that birds have beaks and humans don’t. 

'Eureka,' the AI vendor might say. Now the vendor can assume that because its AI isn't highly effective at detecting birds but is effective at detecting humans, AI should be able to tell a picture of one from the other. That's the logic behind AI antivirus. If AI antivirus can look at thousands of existing samples of malware and identify the vast majority of them as malware, then the vendor can presume that it’s highly effective at detecting similar malware.

However, according to the Skylight researchers, malware makers are not “wooden dummies” -- they fight back and can come up with clever tricks that are easy to implement and could completely confuse the AI. In the above bird versus human example, if a human would wear a mask with a bird beak, said human could be confused for a bird. 

The AI model could be fixed to take other features into account, but those could similarly be fooled, too, which is why the researchers concluded that AI antivirus is nowhere near being the cybersecurity silver bullet that vendors have promised it would be.

Should We Just Kill the AI Antivirus Hype Now?

We’ve seen in different industries that AI that tends to be highly-optimized (or biased) for a particular set of features based on the data it was given. It also seems to be difficult to give the AI the right balance of data covering all aspects of the problem areas. 

Vendors of future AI technologies will likely continue to struggle to find the right balance for the training of their AI solution potentially in perpetuity. Similarly, security experts will have to keep fighting bad actors and exploits against their system and app protections in perpetuity, too.

For businesses, AI antiviruses seem problematic, not just because they can be universally bypassed by malware once whatever bias they have in their model is found, but also because AI-based security solutions need to be fed virtually all of the data that passes through a company’s network. 

This turns the AI antivirus into yet another potentially enormous liability both in terms of privacy and security. The AI antivirus becomes a single point of failure, so if its servers are hacked, all of that enterprise customer data could then be in the hands of bad actors.

However, as long as adding the buzzword "AI" to a product's description increases the hype around it, security vendors will likely continue to benefit from such marketing tactics, even as integrating such AI solutions could potentially weaken enterprise networks. 

The latest Windows update released on April 9 seems to have broken multiple antivirus programs, including Avast, Avira, ArcaBit, McAfee, and Sophos. Computers that are affected by the latest bugs run fine until users attempt to log in. At that point, the operating systems start freezing or just run extremely slowly. Windows 10, as well as Windows 7, 8.1, Server 2008 R2, Server 2012, and Server 2012 R2,  are all affected.

April 9 Windows Patches Cause Systems to Slow Down

After delivering the latest major update to Windows machines, Microsoft has begun adding antivirus clients to its list of programs that are impacted by it. Many users have reported that when running Avast, Avira, ArcaBit, McAfee, and Sophos, their operating systems become highly unresponsive when at the Windows login screen.

Some of the users affected by the latest bugs were able to login into their computers, but it took them ten or more hours. Avast recommended its users to leave systems at the login screen for 15 minutes before attempting to login. Afterward, the Avast update will run in the background. ArcaBit and Avira have published updates that promise to solve the problem for their users.

Users can also boot into safe mode to uninstall their antivirus programs if they want to solve the issue immediately, as the safe mode is not affected by it.

Antivirus Vendors Blame Microsoft For Underlying Change

Avast and McAfee have pointed the finger at Microsoft as the party responsible for all of the recent antivirus issues. Microsoft recently made a change to the client/server runtime subsystem (CSRSS), which is a component of Windows that coordinates and manages Win32 applications. This change has led to the freezing of antivirus clients. The antivirus clients attempt to access a resource, but they are blocked from doing so.

Now that antivirus vendors are more aware of this change (it’s unclear why they weren’t when the change happened in the Insider Preview phase of development), future updates should fix most of the clients.

Kaspersky announced this week that it has filed an anti-trust complaint against Apple with the Russian Federal Antimonopoly Service (FAS) over the Apple App Store by banning features from the Kaspersky Safe Kids parental control app. The cybersecurity company accused Apple of issuing the ban only after announcing its own parental control software for iOS users, Screen Time 

According to Kaspersky, it received a notice from Apple last year saying that the configuration profiles of the Kaspersky Safe Kids app were no longer meeting the requirements of App Store’s policies. However, Kaspersky said Apple never had a problem with its application before this.

The removal and general ban of configuration profiles meant the elimination of two key features of Kaspersky’s app, including app control and Safari browser blocking, Kaspersky said. According to the security firm, these features are essential. The first feature allows parents to block apps they don’t want their kids to run. The second one blocks all browsers on the device except for Kaspersky’s kid-safe browser.

Restrictions Following Launch of Apple Screen Time

Kaspersky said Apple blocked the features of its parental control app after launching its own version of a parental control application, Screen Time. Screen Time allows users to set application restrictions, such as when and for how long an app can be used throughout the day.

Kaspersky believes Apple's restrictions to the Safe Kids app following the launch of Screen Time constitutes an abuse of power worthy of an antitrust complaint in Russia. Apple controls the distribution channel for iOS applications and can leverage this power to enter various markets -- in this case, the parental control software market. Kaspersky’s argument is that by banning or crippling competitors, Apple will become a monopoly in this or other markets.

"From our point of view, Apple appears to be using its position as platform owner and supervisor of the sole channel for delivering apps to users of the platform to dictate terms and prevent other developers from operating on equal terms with it. As a result of the new rules, developers of parental control apps may lose some of their users and experience financial impact," Kaspersky said in its blog post, adding that it "repeatedly" tried to contact Apple but did not reach any "meaningful negotiations." 

Reining In On Monopolies

Kaspersky also filed an antitrust complaint against Microsoft in 2017, accusing it of leveraging monopoly power in the PC market and using questionable tactics to promote its own Windows antivirus software over third-party ones. Eventually, Kaspersky withdrew the complaint.

This month, Spotify filed its own antitrust complaint against Apple in the European Union over the high commission fee Apple charges music streaming service providers. Spotify’s argument is that Apple charges this fee while offering a similar service unimpeded by the samefee. 

U.S. Senator Elizabeth Warren this month proposed that large companies that become monopolies and own distribution channels should not be allowed to publish their own products on those platforms. The argument is that this incentivizes the platform owners to change the platform’s rules so that their own products are recommended above those of competitors.

The European Commission (EC) charged Google with something similar last year in the Android antitrust case, as well as the Google Shopping antitrust case in 2017. In both of those cases, the EC accused Google of using its leverage over the platform to promote its own products. And this week, the EU hit Google with a  €1.5 billion fine over online advertising practices. 

Intel announced some new innovations in anti-virus technology that leverage GPUs and AI to enhance malware protection. The company calls it Intel Threat Detection Technology (TDT), and it consists of two technologies that are meant to speed up virus scans on consumer computers and enhance real-time threat detection in data centers.

Memory Scanning Sped Up With GPU Power

The first part (and most relevant for most users) of TDT is called Accelerated Memory Scanning. Memory scanning is a part of antivirus scans that checks for suspicious patterns in memory access. The idea is that checking the memory footprint of all currently running processes might reveal a malware whose code is well disguised enough that it managed to slip by the file-checking part of the scan. (The latter just checks every file on your disk to find executables that resemble known viruses, whereas the former is meant to catch viruses in execution.)

Running the memory scan is traditionally a CPU-intensive task, but Intel’s new method offloads it onto the GPU. The massively parallel nature of GPUs is well-suited to the task and, according to Intel, can bring the CPU usage of a memory scan down to 20% from 100%. This both speeds up the scan and leaves a computer usable while the scan is running. Intel said that Microsoft will soon integrate Advanced Memory Scanning into Windows Defender, which is Window’s built-in antivirus. There, it will speed up Full scans, which are currently run manually in the Advanced scan section of Windows Defender Security Center.

Intel processors from the 6th-gen (Skylake) and beyond will be able to perform Advanced Memory Scanning. The speedup will hopefully allow Full scans to be run more often and possibly even automatically. Currently, Windows 10 only runs Quick scans, which only does file scanning and basic memory scanning, automatically.

Real-Time Threat Recognition With AI

The second part of TDT is probably less relevant to consumers, but it’s interesting nonetheless. It’s called Intel Advanced Platform Telemetry, and it’s targeted at data centers and cloud-computing farms. It uses machine learning to analyze telemetry data of running computer systems.

“Telemetry data” here probably means any number of data points that Intel can snoop from its processors to characterize their activity. Intel didn’t expand on specifics, but we imagine that these could include cache misses and branch target misses, which are at the center of the Spectre and Meltdown vulnerabilities. The idea is that AI will be able to better recognize when processors are behaving abnormally, which could signify that they’re executing malware.

Whether TDT is a sign that Intel is truly sticking to its commitment of putting security first is up for debate, but it’s good to see the company leveraging its broad adoption in the market to improve security for both corporate and regular consumers.

President Trump signed into law a bill that bans the Kaspersky Antivirus as well as any other software made by Kaspersky Labs from use in U.S. federal departments, agencies, or organizations. The law applies to any company that is controlled by Kaspersky in any way or in which it has majority ownership.

U.S. Government Bans Kaspersky

Earlier this year, a Wall Street Journal report backed by unnamed U.S. government sources said that hackers working for the Russian government stole documents from an NSA agent. The NSA agent in question took home classified data without permission, and because she was running the Kaspersky antivirus, the report alleged that this is how Kaspersky was able to identify the NSA documents.

Kaspersky has admitted that it identified the NSA files, but as soon as it did, the company deleted the documents its antivirus was able to capture for malware analysis. The antivirus firm also offered to allow independent parties to review its software code.

This response doesn’t seem to have convinced too many in Washington, because after the report, Congress has been scrambling to pass a bill that would ban the antivirus from federal agencies’ networks. The ban of Kaspersky’s software from the federal agencies’ networks was eventually written into the National Defense Authorization Act. The bill will go into effect from the start of 2018.

How It All Started

The whole situation seems to have started when an NSA agent, called Reality Winner, who seems to have been a source for some of The Intercept’s national security stories, took home some classified NSA documents. Kaspersky said that it encountered the documents by mistake, as the files were automatically uploaded to its cloud when the antivirus was scanning Winner’s computer.

This is one issue with cloud-based antivirus software - you have to have a high degree of trust in this type of security software when you’re allowing it to analyze every file you have in your computer and then to upload them to the vendor’s servers. Even Microsoft’s Windows Defender has a cloud component that is enabled by default these days.

The other side of the issue is that if Kaspersky wanted to look clean and not look like it stole the files or that it aided the Russian government to do that, it should have probably alerted the U.S. government about this incident itself.

It’s hard to imagine that wouldn’t have made the U.S. government believe its side of the story more, if the company was the one telling the government about the classified data being leaked by a potential rogue agent. In fact, with Kaspersky protecting multiple U.S. federal networks already, one could argue that was already part of its job.

However, Kaspersky didn’t do that, which makes everyone question the company’s motives and become more inclined to believe the accusations that it was somehow aiding the Russian government in stealing those files.

Dealing With The Aftermath

Regardless of whether or not Kaspersky had any role in Russian hackers obtaining the classified information, it looks like the U.S. government has already made-up its mind about the company, which should impact both Kaspersky’s bottom line as well as its reputation as a trustworthy security solution vendor. The company is now likely going to need to work extra hard to gain its customers' trust again.

Last we heard, John McAfee had sold the rights to make the movie based on his life. Now it seems McAfee is dabbling in a bit of film-making by himself. The 66-year-old founder of McAfee sold off his shares in his company after it went public in the 90s. Over the last year or so, he's found himself the subject of some pretty nuts headlines. He was arrested in Guatemala in December of last year having been on the run since November (he was accused of murder). Now it seems he's trying his hand at a bit of tech support for McAfee users.

McAfee explains in a video posted to YouTube that though he hasn't been involved with the company for a very long time, he still gets a lot of mail from folks trying to figure out how to uninstall McAfee. The video is definitely weird. It does explain how to uninstall McAfee, there just also a lot of swearing, scantily clad girls, bath salts, and guns. Needless to say, it's not exactly family viewing. Check it out for yourself below:

AVG Technologies has launched its 2013 consumer lineup of PC security and maintenance software, including the popular AVG AntiVirus Free downloadable.

One of the new highlight features for 2013 is its support for Windows 8's "Modern UI" that's optimized for touchscreen displays. Computer users who chose to stay within the confines of the Modern UI will have access to all of the AVG software features. Of course, the traditional desktop mode is still expected to be the most used, while the truly hardcore can still access the command line in the 2013 package.

AVG has also upgraded performance. The company sent its software off to Dennis Technology Labs and the software, as compared to the previous version, had a reduced startup time by 26 percent. Scanning time was faster by up to 36 percent, and the user interface loaded three times more quickly.

The faster scan times will be greatly noticeable those who are running on older PCs with traditional hard disk drives. Rather than seeking back and fourth on a disk drive, AVG 2013's scan software follows the order in which files are physically saved on a disk. Independent testing has found that this scans can finish up to 36 percent faster this way.

The file scanners use what AVG is calling "file reputation technology" that further enhances detection and reduces false alarms by checking a file against a cloud database. AVG's user base numbered 128 million worldwide at June 30, 2012.

In the 2013 software, AVG claims that it has enhanced and simplified the firewall making it easier for users to choose how they want to personalize their settings in order to protect their privacy and identity online. Earlier this year, AVG introduced its active Do Not Track feature, which lets users view and customize about that is tracked about them on the web. AVG told us in a meeting that it believes that users should be able to choose which information is tracked about them rather than a full blanket policy.

"We were the first antivirus company to offer a free product to all users ten years ago and in March 2012, we were also the first to provide an active Do Not Track privacy feature in both our free and paid products," said JR Smith, CEO of AVG Technologies.

AVG's 2013 product line includes AVG AntiVirus Free, which will protect users on the web, emailing and social networking without costing a cent. There is also a paid option (called just AVG AntiVirus – no Free) that adds more advanced features.

AVG Internet Security 2013 comes with an integrated security firewall, LinkScanner, Anti-Spam, Anti-Spyware and technology to protect against Wi-Fi hacking.AVG also offers the PC TuneUp software that it claims will help users maintain their computers by cleaning the hard drive, fixing issues, preserving battery life on laptops, and eliminating freezing and crashing.

Those interested can check out AVG AntiVirus Free 2013 here.

_{Read more from @MarcusYam on Twitter.}

_{Contact Us for News Tips, Corrections and Feedback}

Contest closed

Congratulations to John Cummens from Bozeman, MT!Thanks to everyone who entered, and stay tuned for more contests.

Original story:

What better way to start off a brand new week than with a chance to win a Tom's Hardware System Builder Marathon Enthusiast PC! Not only that, but this rig – with an approximate retail value: $1,250.00 – comes with lifetime protection from GFI Vipre Antivirus Home.

Here's the full package:

• Antivirus Software: Vipre Antivirus Home (Lifetime License, provided by GFI Software)
• Case: RAIDMAX SEIRAN (provided by RAIDMAX)
• Power: RAIDMAX RX-850 W ATX12V, EPS12V, 80 PLUS-Certified (provided by RAIDMAX)
• Motherboard: EVGA P67 Micro SLI LGA 1155, Intel P67 chipset
Processor: Intel Core i5-2500K, 3.3 GHz (3.7 GHz Turbo), Quad-Core, 6 MB L3 Cache
• CPU Cooler: Cooler Master Hyper TX3

• Memory: Mushkin Enhanced Redline 4 GB (2 x 2 GB) 240-Pin DDR3-1600 Kit Dual-Channel Desktop Memory Kit
• Graphics: 2 x EVGA GeForce GTX 460 1 GB 1 GB GDDR5
• Hard Drive: OCZ Vertex Series 30 GB SATA II SSD 30 GB, SATA 3Gb/s
• Hard Drive: Western Digital Caviar Black 750 GB 750 GB, 7200 RPM, 32 MB Cache SATA 3Gb/s
Optical Drive: Sony Optiarc DVD Burner 24x DVD Burner
• Operating System: Windows 7 Home Premium

The contest opens on October 10, 2011 10 a.m. EDT and closes October 24, 2011 10:00 a.m. EDT. We'll announce the winner by November 4, 2011.

One winner will be chosen randomly. Throw your name into the entry hat here.

Good luck!

_{DUE TO LEGAL REQUIREMENTS, THIS CONTEST IS LIMITED TO LEGAL RESIDENTS OF THE USA (EXCLUDING RI) AND 18 YEARS OF AGE OR OLDER.}

_{UNLESS OTHERWISE NOTED, ALL PERSONAL INFORMATION WILL ONLY BE USED TO QUALIFY AND CONTACT THE WINNER.}

Antivirus Need...and Greed

Let’s start with the good news: antivirus products all work. If what you care about is protecting your system from viruses and similar digital pathogens, just about every major vendor in the AV space does a respectable job. But don’t take my word for it. Check out AV-Comparatives, which currently evaluates 20 of today’s most recognized names in the antivirus world.

The above chart shows AV-C’s results for August 2011. Now compare against the same tests done in August 2010.

While it’s interesting that the three top performers on these charts are consistent, the point is that most players can change considerably from year to year, and even month to month. Does anyone really think that Microsoft went from 98% accuracy in 2010 to 92.5% and stayed there? As if the company suddenly forgot how to write virus definitions? No. Quite literally, sometimes AV companies have bad days. In the 2011 AV-C tests, Sophos and Webroot (which uses Sophos technology) were the only vendors to be dropped from the testing because the cloud-based portion of Sophos’ definition set was down.

As multiple vendors agreed in interviews with us, when it comes to detection and isolation of modern viruses, worms, bots, and so on, just about everyone does at least an adequate job.

“Most of us are close,” says Dodi Glenn, product manager at Vipre Antivirus. “The thing is, you could say that you detected some sample set, and your AV is better than mine. But if you fast forward, I could say that you missed X, Y, and Z. There’s a notion of when you gathered the data. And is it a zero-day? Has it never been seen before? Is it a proactive or reactive type of detection? It all depends on the sample set you’re using. In theory, your efficacy rate is going to change any time you update.”

Accuracy may no longer a primary criterion for product selection, although it should still be considered as a secondary item after pricing and full AV suite functionality. There is another side to consider with AV products, though, and long-time Tom's Hardware readers know it well. What impact is the software having on your system? Loads of features and stunning detection accuracy may be impressive, but if the background AV product is sucking minutes or hours of your productivity and performance away from foreground tasks, you have a problem. In general, for reasons we’ll discuss soon, we are less concerned about the impact of scheduled scans than we are about the low-level monitoring that today’s AV products perform constantly. Will they slow your gaming? Will they balloon your Web page load times?

We don’t need an exhaustive answer from examining two dozen names. We figured that half of a dozen would do for establishing whether or not AV products in general are dragging on your system and if there is a significant variance in this drag between products.

Contenders: AVG And GFI

We felt it was important to represent a couple of the leading free AV products in our selections, and by our totally informal reckoning, AVG Free and avast! are two of the most popular. We certainly had several people in our last AV roundup request avast!. However, since that company is based in the Czech Republic and didn’t answer our press query, while AVG (located only three time zones away) bent over backward to help and participate, it made our choice simpler.

AVG Free (free.avg.com), as with most no-charge AV products, provides you with a solid antivirus core and little else in the way of free amenities. Most notably, the product lacks a firewall, so there’s no guarding inbound or outbound packet sniffing. Does it matter whether you detect a malicious before or after it reaches your system? Probably about the same as it matters if you extinguish a burning torch in your driveway instead of your hallway. You just don’t want something dangerous coming inside.

AVG Free still monitors your browsing and social networking. You’ll find a nifty tool called AVG Advice that proactively monitors Chrome, Firefox, and Internet Explorer, alerting you in the event of any “overuse of memory” by a browser. You’ll also be warned if AVG’s LinkScanner determines that a site is untrustworthy before you visit it. For $36, you can step into AVG Anti-Virus 2012 and thereby grab a firewall and priority tech support. For $49.49, AVG’s Internet Security 2012 will safeguard your wireless connections and email, as well as allegedly accelerate system start-up and rich content downloading.

GFI Vipre Antivirus (www.vipreantivirus.com/) comes to this story as our dark horse, a new contestant in our testing. Previously sold by Sunbelt before being acquired by GFI, the standard edition of Vipre covers antivirus, antispyware, email protection, and rootkit detection/removal. Vipre Premium adds in a firewall, ad blocking, Web site blocking, malicious script blocking, and more.

We can debate whether Vipre brings much that’s new to the AV space, but we definitely like having readily available phone tech support here in the U.S. Equally inviting are the product's flexible billing options. There are no auto-billing subscriptions—nice. Instead, you can select whether you want a license for one, two, or three or more systems, as well as a license duration of one, two, or three years or the PC’s lifetime. The Premium product spans from $30 for one year on one PC to $150 for lifetime support on three or more systems.

Contenders: Kaspersky And McAfee

We aimed in the middle of Kaspersky’s AV stack and trialed the Internet Security 2012 version ($65; usa.kaspersky.com). For another $5, the Pure Total Security edition adds centralized security management for all household systems, parental controls management, a password manager, file wiping, and data backup.

Kaspersky recently overhauled its GUI, making it much simpler to work with. The company now hosts its reputation-based advice system in the cloud, which may add a little latency. But, on the other hand, it’s good to have a resource able to caution you about a given file’s trust level before you open it. The same cloud-based resources can also check application components, such as DLLs, and email for spam screening. Another clever Kaspersky addition here is malware rollback, which eliminates any system changes made by malware to the conditions of a previous session.

McAfee Internet Security ($50; home.mcafee.com/store), was recently acquired by Intel. Why? We asked, but reps only said that we’d find out very soon, wink-wink. The AV app has been around forever, of course, and is a perennial favorite for OEMs and service providers to offer as a customer incentive. In addition to antivirus, antispyware, and firewall protection, McAfee likes to talk up the product’s new anti-bot capabilities. Safeguards against malicious iFrames also bolster the app’s Web-based resume, as does “Deep Page Protection,” which alerts users before they step into a suspect Web site. We also like that McAfee automatically scans any added USB or other removable storage device.

Stepping up to McAfee Total Protection ($60) raises the package’s online storage from 1 GB to 2 GB, which is still lackluster in an age when 2 GB Dropbox and 50 GB ADrive accounts are free. The best draw in the higher-end product is anti-phishing protection. Otherwise, stick with the already well-endowed Internet Security 2012, which still provides functions like network monitoring (to show if you have rogue devices on your network) and Super Mode (a deeper inspection mode that kicks in when malware is detected).

Contenders: Microsoft And Symantec

As the closest thing to a free "de facto" AV product on the market, Microsoft’s Security Essentials is sort of a must-have in a round-up of this sort, if only to use as a possible baseline for judging against other products. As you can see in the earlier AV-C charts, Security Essentials isn’t known for being best-of-breed, but it also doesn’t have to be. As a fairly stripped down, antivirus-only tool, it just has to be good enough. Which it is. You don’t see forums filled with people lamenting how viruses killed their systems because Security Essentials is useless. You see lots of complaints from people who didn’t install any AV product.

Microsoft installs quickly and updates with no hassle. As usual, we accepted all of the program’s default settings, save for disabling the scanning schedule. Security Essentials also prompted us to enable Windows Firewall if we didn’t have any third-party apps serving in its place, so we did this, as well. You don’t get much ability to configure or customize here, but that shouldn’t bother most mainstream users.

Symantec’s Norton Internet Security ($70; http://us.norton.com/internet-security/) descends from what may be the oldest, most successful, and most criticized AV product in the market. Norton has always strived to be the most feature-rich AV title available, and there was a long stretch of time in which that also meant being the most demanding on system resources. In this sense, the cure was often worse than the disease, and a Norton AV scan could often bring a single-core system to its knees. Of course, this led the market to value features like off-hours scheduling, deferred scanning during non-idle times, and making low CPU impact a top priority. The company is so phobic about this now that the phrase “Stop online dangers without sacrificing performance” is its top marketing bullet.

As the next image shows, Symantec makes heavy use of reputation analysis (branded as Download Insight 2.0) in its AV. You also get identity protection, antispyware, antispam, firewall, and phishing protection, all wrapped up in a slick UI that puts a fairly simple front end on a ton of options settings. The $70 price is for up to three systems for one year. A two-year license runs $115, and three years notches to $165. If you don’t mind giving up parental controls, malicious Web site blocking, some identity protection features, and Symantec’s password wallet, you could slide back to Norton AntiVirus 2012 ($40 for one year/one PC, $70 for three years/three PCs).

How We Tested: Configuration

We tested on an open bench system comprised of the following components:

• Intel DX50SO2 motherboard (BIOS version 0876)
• Intel Core i7-2600K processor (Hyper-Threading enabled, 3.4 GHz)
• 8 GB (2 x 4 GB) OCZ Gold Edition 1333 MT/s DDR3, 9-9-9-20
• Sparkle Calibre X560 DF
• Western Digital Scorpio Blue 750 GB (primary drive)
• Patriot Wildfire 240 GB (secondary drive for image cloning)
• PC Power & Cooling Turbo-Cool 860

On this hardware platform, we installed Windows 7 Professional 64-bit and applied all critical update patches effective October 2, 2011. This also included: 

• Nvidia GeForce driver version 280.26
• Intel / Realtek ALC audio driver 6449
• Intel / Renesas USB 3.0 driver 2.1.25.0
• Intel Pro Network Connections LAN driver 16.5
• Intel / Marvell eSATA driver 1.2.0.7700
• Intel RST driver 10.6.0.1002
• Intel chipset device software 9.2.0.1030

Rather than run a totally clean configuration, we additionally installed the following applications to better mimic a real-world system:

• Google Chrome 14.0.835.163
• Firefox 7.0.1
• OpenOffice 3.3.0
• Google Picasa 3.8
• Apple iTunes 10.4.1
• Apple QuickTime 7.7
• Adobe Flash Player
• Adobe Reader X 10.1.1
• 7-Zip 9.20 for 64-bit Windows x64
• CPU-Z 1.58
• Microsoft .NET 4
• Microsoft SDK 7.1
• PCMark 7
• HTTPWatch

With all of this software installed, we then disabled UAC, Windows Update service, the screen saver, Windows system restore, all task scheduler events, Action Center notifications, automatic Windows Error Reporting, taskbar notifications, all hibernate/standby power settings, and Windows Media Player services. Firefox, Chrome, and IE were all configured to disable the initial wizard and crash prompting while their home page was set to about:blank.

Finally, we copied 10.0 GB of photos, video, and document files into a sample data folder. This comprised our “clean” image. The image used only a single account with no password to ensure automatic login after rebooting, and no unknown devices were present in Device Manager. All automatic updating tools were disabled, and we rebooted Windows before using Symantec Ghost 15.0 to back up the image to a secondary drive. Only after this image was created and finalized did we run our first tests and subsequently install our AV contenders. After testing was completed on one AV product, we would reformat the Scorpio drive, then copy the clean image back to the newly formatted drive for loading of the next AV product.

How We Tested: Benchmarking

We used a 5400 RPM, 2.5” hard drive (rather than a more enthusiast-oriented) conventional SSD specifically to slow down our test times and magnify any differences that the AV products might be exerting on storage operations. In the same vein, this is also why needed a higher caliber of timing tools. A simple stopwatch is too imprecise for several of these tests. Instead, we turned to Microsoft’s Windows Performance Analysis toolkit. The need for this should be clear from the following Microsoft data (found in http://bit.ly/oOg71J):

We combined methodology suggestions from AVG, GFI, McAfee, and Symantec to arrive at our final test set as described below.

1. Install time. Using Windows PowerShell running with admin rights, we measured the installation time of LibreOffice 3.4.3 with this command:

$libreoffice_time=measure-command {start-process "msiexec.exe" -Wait -NoNewWindow -ArgumentList "/i .\libreoffice34.msi /qn"}

$libreoffice_time.TotalSeconds

2. Boot time. We used Windows Performance Analyzer’s xbootmgr and xperf tools to measure time elapsed across five looping boot cycles. Our score shows the mean time of the five cycles. Our command was:

xbootmgr –trace boot –prepSystem –numruns 5

3. Standby time. We used Windows Performance Analysis xbootmgr and xperf tools to measure time elapsed across five looping standby cycles. Our score shows the mean time of the five cycles. Our command was:

xbootmgr –trace standby –numruns 5

4. Synthetic performance. Our only conventional benchmark in this group, we used PCMark 7 to illustrate performance across a range of conventional computing tasks.

5. Page loads. We selected the following element-dense pages and used HTTPWatch to measure their load times in Internet Explorer 9.

• http://online.wsj.com/home-page
• http://www.tomshardware.com/
• http://disney.go.com/index

6. Scan time.
This time, a simple stopwatch would do, although most AV vendors display their scanning run times within the application. Given the time scale involved, we felt confident simply using these rougher tools. Because many vendors cache scanned files, we’ve broken out data for the first full scan and a mean value of three subsequent scans. The test system was rebooted between each scan.

Application Installation

On McAfee’s advice, we opted to test application installation times with the expanded .msi executable for LibreOffice 3.4.3 running under Windows PowerShell with Administrator rights. PowerShell’s UI looks much like a command prompt, and our command reports back with the exact time spent on file installation. Note that the /qn argument suppresses all of the usual installation pop-ups for which you inevitably click the Next button.

The standout surprise here is GFI Vipre Antivirus. We expected all application installs to be slower with AV running than on our clean configuration since AV products all run in the background, monitor file unpacking, and add resource overhead. Honestly, we’re stumped as to how GFI achieves this, but the company does stake much of its product marketing on speed. We suspect that subsequent image re-installations and test averaging might have yielded numbers closer to that of the clean image, and what we’re seeing might be a statistical outlier. Still, even at parity with our clean time, GFI blows away the rest of the field on app installation performance.

Perhaps not surprisingly, AVG and Microsoft deliver our next best times. Compared to Kaspersky, Microsoft, and Symantec, our two free AV products are considerably simpler and more pared down in their feature breadth. Perhaps an abundance of analysis is leading to installation paralysis? Certainly, installing an office suite to a 5400 RPM hard drive in under three minutes is nothing to sneeze at, but the other way to look at this is that Symantec added 60% to our application time. If you tend to do a lot of program loading, this could be a concern.

Boot Time

This was our first experience testing with Windows Performance Analysis tools. No doubt, this is old news to software developers, but for us, it was a great opportunity to dig into the individual software traces that happen during regular operations. For those who think that Microsoft gives short shrift to things like boot-up time, know that the company has devoted ample effort to making sure that OEMs have such tools and know-how to use them. A system builder has the power to see exactly how this or that bit of pre-installed code impacts other traces and where stalls are happening at the millisecond scale. Whether builders make effective use of these tools is a different story.

We ran this test three times, but there was no getting around the data before us: our clean config was the slowest for boot-up. Every AV product seemed to somehow accelerate the booting process. Perhaps this is somehow done with caching? We don’t know, but the average improvement over clean running was about 15 seconds.

GFI alone pulls ahead of the pack, shaving nearly 30 seconds off of our AV-free boot times. The other five contenders are statistically in a dead heat.

Note that we discovered an “aggressive boot time” setting in Symantec’s options, which is disabled by default. This default setting is what we reported above, but then we ran a second set of data with the option changed from “off” to “aggressive.” The resulting average time was 165.131 seconds—virtually no difference from the disabled score. If that’s the case, what is this feature doing, why is it disabled, and what does “aggressive” mean here?

Standby Time

The funny thing about standby time as a performance metric is that it’s commonly cited, yet infrequently relevant. Think about it. How often do you actually command your system to enter standby mode and then sit around waiting for it to happen? You don’t. Much more often, your system will slip into standby or hibernation as a result of power saving during prolonged idle time—when no one is present and waiting for the process to complete.

Still, standby is generally held up as another indicator of system impact, so we ran the tests.

Here we see a bit more differentiation than in our boot time results. Again, GFI turns in the best score of the group, still somehow beating our clean configuration. Now, though, McAfee and Microsoft also slip in ahead of our AV-free system. Symantec barely registers a slight impact, and Kaspersky and AVG come in close together at the back of the pack.

Despite there being a 28% variance from first to last place in this group, we’re not sure how much emphasis to place on this as a statement about overall performance. A positive or negative range of only nine seconds on a relatively slow system disk is fairly minor no matter how you look at it.

PCMark 7 Results

Here we come to the meat of our testing. When you have real applications running and you’re manipulating real media content, how much of a burden is your AV software? There are two ways to look at the answer, and we’ll show both. Here are the overall PCMark7 score results with the horizontal axis set to Auto:

This view magnifies differences in the results. The obvious conclusion is that Kaspersky seized the day and Microsoft...didn’t. Now let’s start the horizontal axis to 0 and see how things look:

It’s an even field, right? Suddenly, you no longer care about performance—they’re all practically the same—and you’re back to thinking about pricing and features. In fact, the real take-away here might be that there seems to be little to no impact from AV products on application performance. Kaspersky and McAfee even slip in just under our clean config score, again defying intuition and making the case for normal statistical variance in this test load.

So much for our lesson in statistics manipulation. You know that PCMark is comprised of several tests examining different usage scenarios, so let’s break this down.

A few AV products claim to improve rich media content performance, but if this test, which focuses on video playback frame rates, is any indication, such enhancements are totally absent from our test group. We found no statistically significant variance.

With video downscaling, we see a big of wiggle. In an odd twist, every competitor except Microsoft narrowly outperforms our clean configuration. AVG squeaks in with the win, but it’s practically a photo finish for all players. Again, we see little influence from antivirus background scanning in either direction.

PCMark 7 Results, Continued

We expected to see some of the most variance within the PCMark suite here, as gaming storage throughput might be the most sensitive to impacts from background file scanning. Not so. Only GFI and Microsoft show any real influence on scores, and even then the improvement is minimal. Once more, we see AV not hindering system performance.

Perhaps this is our most damning data point. Top to bottom, we see a roughly 12% impact against DirectX 9 performance across the board. No AV product does better than another at preventing this. It seems to be an inherent liability baked into the background scanning process.

Still image manipulation performance? Zero impact from AV presence. Nothing to see here...move along.

Importing photos is another place where we expected to separate the wheat from the chaff, as this would keep AV scanning constantly busy watching incoming files for malicious bad apples in our barrels of photo files. Yet again, there’s not much variability. GFI and Microsoft tie for delivering the best storage performance. And strangely, our clean configuration shows the worst performance of the bunch, lagging the leaders by about 10 percent. So AV is good for storage and bad for graphics? Weird.

Finally, some data that matches our presuppositions. The clean configuration shows the highest Web page browsing speed, which makes sense as the results are totally unscanned. GFI seems to spend the most cycles on page element analysis, bringing up the back of our fairly tight-knit pack. Microsoft comes the closest to native speed, although, given AV-C’s detection results, we have to wonder if this is because Security Essentials isn’t doing as thorough of a job.

The data decryption side of Web browsing tends to lean more heavily on CPU performance, so we would expect to see AV apps with higher CPU utilization resulting in lower scores here. It’s possible that such an effect is seen here, but with the groups laggard (Symantec) turning in a score only 3% below native speed, we’d call this a non-issue. The preliminary conclusion would be that AV is not affecting CPU performance.

Finally, we have Windows Defender performance. Defender guards against spyware. It’s a free download and a fairly necessary one if you’re only going to run a basic, free AV app. This time, Kaspersky falls behind while all other AV products show a fair performance gain over our clean baseline, led by AVG and GFI.

Web Page Load Time

We have PCMark for our synthetic tests, so we wanted to use three real, commonly traveled, and highly stuffed Web pages for our assessment of AV impact on real-time browsing. As you might expect, pages can vary considerably in how they integrate third-party elements, such as hosted video and banner ads. We suggest considering all three result sets together.

We can only make a few general statements in looking over these charts. First, we see that the clean configuration is almost always the fastest. This is to be expected. Only once, on the Disney home page, does a single product slip in with a slightly faster score, and we attribute this to temporary Internet congestion slightly skewing our clean config numbers.

Of the three charts, we prefer the Wall Street Journal results as being the pattern that most fit our expectations. It may be that Microsoft puts the least effort into advance page scanning and so reports back the fastest results of the AV contestants. We can debate whether the other products are simply slower and more cumbersome or if they do a more thorough job of applying reputation analysis and other factors to provide advance warning to users if needed. Either way, we like seeing that the AV products are doing something.

Is a 10-second slow-down worth worrying about? Yes. Believe it or not, a 10-second delay experienced 100 times in the course of a day means more than 16 extra minutes of sitting around waiting for pages to load. That’s an entire break time broken up so minutely that you have no time to actually enjoy the break. On the other hand, consider the potential time lost and heartbreak gained by picking up malware from an unscreened site. We’ll take the 16-minute loss and hope AV vendors can improve their scanning algorithms in the future.

Scanning Time

Antivirus scanning is an odd beast. Everybody wants to know the numbers, but the means with which the results are generated can be so various as to be meaningless. Moreover, we come back to real-world applicability. If you’re running a deep scan in the middle of the night, do you care if it takes 10 minutes or two hours? If, for some strange reason, you run a scan while working on other tasks, do you care so long as there’s no noticeable impact on system resources? Honestly, we don’t. But for those who like numbers as a way to grade product options, here goes.

The first full system scan will almost always be the slowest. This is because most AV products perform some caching. The rationale is that, provided no malware is detected in the system, why reinvent the wheel? Why burn a lot of time and cycles performing deep inspection on files that are already known to be safe? This is akin to doing a differential backup rather than a full system backup.

AVG and McAfee are the big surprises here. In fact, there almost seem to be two approaches to deep scanning. Is it a coincidence that AVG and Kaspersky are in the back half of AV-C’s missed samples results? Maybe, but so is Microsoft, which is our second-slowest scanner behind GFI.

Subsequent deep scans seem generally to accrue cached data until a steady performance level is reached. For example, our three subsequent scan times for Symantec were 29:50, 6:01, and 6:15. Microsoft progressed from 1790 seconds to 361 and 375, or just over six minutes. So, our mean times reported here are actually skewed to the high side in cases where caching progresses to an eventual baseline. The notable exception is GFI, which clearly does not cache and exhibited no drop-off from the first scan to subsequent scans.

Do Antivirus Suites Have A Big Impact On Performance?

We’ve hit the highlights in terms of time and system performance considerations here, although there are a few loose ends. For instance, AV product installation could be an issue. Most products install fairly quickly and smoothly, but some may be less intuitive than others in guiding you through an initial definitions update.

For instance, initial setup with GFI Vipre was slightly unusual. The program installed normally and requested a reboot, which we did. Upon resuming, Vipre did its usual thing and had us download a definition update, which took about three minutes or so and requested another reboot. However, upon our next return to the application, the main UI still showed that Active Protection was not enabled, even though it looked to be so in the options, and we appeared to have still not implemented a definition update. So we polled for new definitions again, and this time the download took over 20 minutes on our 15 Mb/s FiOS downlink. But once obtained, the new definitions installed quickly and resulted in both the Updates and Active Protection icons changing to green check marks. Good to go.

Another potential time sink comes after the scan when you assess results. Symantec excels at finding tracking cookies, regardless of whether you consider these important (the program’s options will let you filter out certain threat types, if you’re really annoyed). Our initial scan found 22 tracking cookies while, for example, McAfee found four. Do we care? Not really, and we’d rather not have to consider if the “threat” is worth worrying about. We use AV products in part to make such decisions for us.

As for impact on CPU utilization, all products seem to be fairly even, falling in the 4% to 11% range. We found that McAfee edged a bit higher, trending in the 10% to 15% range, which could explain some of the company’s lower scanning times, although we’re still baffled by that first deep scan score. One likely reason why AVG performs so quickly in scanning is that it will ratchet into high priority mode when your system goes idle. When you return, the app reverts to low priority mode.

In retrospect, we have to wonder if it was a mistake to run these tests on a modern quad-core processor (Core i7-2600K). In reality, the CPU is so fast that it’s hard to register a significant load from even the most demanding AV apps. In our opinion, that’s the big message of this article. We’ve seen some AV companies trumpet CPU utilization scores showing how much less impact their product has than others. Apparently, this is somewhat like saying you can boil water at 230 degrees Fahrenheit instead of 260 degrees. As long as the water is at 212 degrees or higher, no one really cares. What might have once been a serious concern in the single-core days, or even still on low-end, low-power processors, is no longer a worry on modern platforms. The load from any of these AV products is negligible with such horsepower under the hood.

On that basis, we conclude that, in most cases, performance may be a secondary concern when selecting an antivirus product, but it shouldn’t be one of your first criteria.

Enter to Win a Tom's Enthusiast PC with Vipre Antivirus here.

Why Choose Kaspersky for Your Internet Security

Choosing an Internet security suite is the most vital software choice you make. It’s the chief factor in your computer becoming infected or hacked, where you could lose valuable files and your time and money in getting it fixed. Thus you should choose carefully and don’t just settle with the security software that came preinstalled with your computer.

The virus detection effectiveness is the most important aspect of an Internet security suite. Consequently the underlying detection and protection techniques are also vital, especially to help protect against brand new—zero-day—viruses, malware, and other vulnerabilities.

Malware can be created and self-replicated quicker than antivirus vendors can update their virus signatures, the updates downloaded to your antivirus program used to compare your files against. A virus signature blocks only one specific variation of a virus or malware.  However, certain malware families can spawn hundreds, if not thousands of variants, and all these variants require signatures. Thus Internet security suites need to have advanced protection techniques, beyond traditional virus signatures, to help catch these.

One of the ingredients Kaspersky Labuses to create a highly intelligent and effective antivirus solution is cloud-based protection, in addition to traditional protection provided by virus signatures. The cloud (or online) protection provides a direct connection to their Urgent Detection System, so threats can be identified and neutralized quicker. This protects against zero-day infections and intrusions. It also helps keep computers protected even if the downloaded virus signature updates aren’t current, an inherent risk of traditional antivirus solutions.

For over a decade, Kaspersky Lab has been helping protect computers against malware, hackers, and other vulnerabilities. Their products have protected more than 300 million systems around the globe, including home and mobile users, small and medium sized businesses and large enterprises. Kaspersky Lab’s products are also award-winning and have proven effectiveness as shown by third-party independent tests.

They were most recently given the highest possible Advanced+ rating by AV-Comparatives in May 2011 for Retrospective Testing.

They also received top marks and above industry average scores for detection tests by AV-Test.org in February 2011.

Understanding Hybrid Protection

As mentioned, the Cloud Protection in Kaspersky Lab products provides a direct connection to their Urgent Detection System (UDS), which contains real-time characteristics of new malware or malicious websites. This is updated in part by the Kaspersky Security Network, which is made up by analyzing threat information from millions of other participating Kaspersky users. Kaspersky Lab products check the UDS database constantly, such as when you open a file or click on a link. If the program or website has the same characteristics of any threats in the UDS, they would be immediately blocked.

Cloud protection alone, however, isn’t enough to keep computers adequately protected. A combination of cloud-based and traditional protection is ideal and provides the greatest protection. This is what Kaspersky Lab’s deploys in their products, which they call Hybrid Protection. They consult real-time virus and threat information online in addition to using the traditional antivirus updates downloaded to your computer.

Here are a couple of security features that benefit the most from the Hybrid strategy:

·         Anti-Malware: It can better detect and catch malware—whether it’s a virus, worm, Trojan, root-kit, or spyware—since the cloud protection provides real-time information on the newest threats.

·         Anti-Phishing: It provides protection against the latest phishing schemes that try to steal your personal information.

·         Program Reputation: It can provide a real-time report on the reputation of programs based upon expertise from security professionals and feedback from other users.

·         URL Reputation: Websites and links are analyzed more quickly, keeping you from browsing to the latest dangerous sites.

·         Anti-Spam: It provides enhanced spam detection to catch the newest junk mail from filling your inbox.

With Hybrid Protection, you aren’t limited in the settings and features you can access like with other cloud-only solutions.  Kaspersky, for example, provides all the usual settings to customize protection and lets users perform scans and other functions at will.

At the same time, the cloud protection is transparent to the user. No additional settings or tasks are required. Cloud protection simply just works when you’re connected to the Internet and automatically stays in sync with the Kaspersky servers.

Protecting Against the Primary Internet Threats

Viruses, spyware, and other malware are the primary Internet security threats. They can slow down and damage your computer, corrupt your files and documents, and help steal your sensitive information, identity, and even money. The most basic method to detect malware is checking files against a database of known malware, the virus signatures or virus definitions. Heuristics is another popular detection method, particularly to help catch unknown or new malware by analyzing files with an algorithm to find suspicious behavior or code.

Kaspersky Lab deploys both the highly customizable virus signature and heuristic malware detection methods in their products. In addition to the traditional real-time file protection that scans opened, saved, and active files, it has separate scanners for email, web, and IM. Furthermore, all methods are enhanced by the cloud protection. By also consulting with the real-time Urgent Detection System (UDS), the Kaspersky software can protect you against the very latest threats.

Hacking, network attacks, and intrusions are another crucial Internet security threat. Human hackers and/or automated systems called botnets can potentially connect to your computer to infect it (or your entire network), bring it down, take it over, or steal information. The most basic defense against hackers and intrusions is provided by a firewall. It allows or denies the Internet and local network traffic based upon your settings, what programs or ports you allow. However, a basic firewall doesn’t provide full protection against network attacks, such as Denial of Service (DoS) and Buffer overflow attacks. An enhanced firewall or separate component is needed, that’s specifically designed to analyze, detect, and combat these attacks.

Kaspersky Lab’s premium products include a highly configurable 2-way firewall that can regulate incoming and outgoing traffic based upon rules for applications and traffic.

In addition to the typical allow or deny settings, you can customize the exact permissions of programs, such as its read/write access to certain system components.

The cloud protection also provides up-to-date reputation data on programs, which is automatically applied by it assigning programs to the appropriate level of trust. Additionally, a Network Attack Blocker is included. It monitors for network attacks and will automatically block computers when suspicious behavior is detected.

Spam and phishing are two more big Internet threats and usually go hand-in-hand. In addition to being annoying, the majority of spam is phishing scams trying to trick you into handing over personal info, login credentials, or money.

Kaspersky Lab includes spam and phishing protection in their products that uses heuristics, link checking, sender addresses, and phrases to help identify junk or fraudulent messages. The cloud protection helps here too. The links are checked against the UDS database so you’re protected from the latest dangerous sites.

Additional Protection Measures

We discussed the main Internet security threats and how to combat them at the perimeter—before they hit your computer. But what happens if you already have malware on your computer or somehow it’s not detected by your antivirus software? Well, Internet security suites should have a “Plan B”, or some monitoring component that analyzes applications and the system for malicious activity.

Beyond catching viruses, Kaspersky Lab features Application Control and System Watcher to help detect any malicious activity on the computer. Application Control classifies all applications and restricts their behavior based on their security status derived from the cloud-based protection, heuristics, and any custom rules you set. It can help detect malware not caught by the main virus scanners or other trusted applications that may be used as a middle-man to do damage.

System Watcher monitors system activities coming from applications using heuristics and can even rollback system changes made from malware.

Internet security suites should also have a way to test unknown applications by including what is commonly called sandboxing. This means the Internet security suite can run the program in an isolated virtual environment (the sandbox) where the program can’t do any damage to the system if it is indeed malware.

Kaspersky Lab features a few sandboxing features. Safe Run for Applications lets you enter a virtual environment where you can run programs, play with settings, browse the Internet, or do whatever, and no changes are made to your actual system.

Alternatively, you can use Safe Run for Websites to put just the web browser into the virtual environment. This can help protect your personal information from any spyware or keyloggers on your computer when logging into sensitive sites or providing payment.

Protecting Your PCs with Kaspersky

We discussed the primary Internet security threats—malware, hacking, phishing, and spam—how to protect against them, and how the Kaspersky Lab products can help. Remember, cloud protection—like from Kaspersky’s Urgent Detection System—can better help identify and catch those new zero-day infections and dangerous sites.

Kaspersky Lab also includes bonus tools in their products. You can create a Kaspersky Rescue Disk to scan unbootable PCs or those with stubborn infections that can’t be removed within Windows. The MS Windows Troubleshooting tool can search for and repair system settings, the Privacy Cleaner can clear cache and temporary files, and the Browser Configuration tool can analyze the security of your Internet Explorer settings.

Kaspersky Lab offers a product line with varying security features, license lengths, and number of supported PCs, so you can choose the one that best fits your needs and budget:

·         Anti-Virus 2012 ($39.95 for 1 PC) is the most basic option includes the Hybrid Protection for malware and phishing protection.

·         Internet Security 2012 ($79.95 for 3 PCs) adds the firewall, spam protection, and parental controls.

·         PURE Total Security ($89.95 for 3 PCs) adds backup and encryption capabilities, a password manager, and the ability to centrally manage the security of all your PCs from one computer.

·         Small Office Security ($179.95 for 5 PCs), basically their PURE Total Security product designed specifically for small businesses.

Keep in mind, Kaspersky Lab doesn’t just protect Windows PCs. They have Anti-Virus for Mac, Mobile Security 9 for smartphones, and Tablet Security for Android-based tablets.

Want to try before you buy? No problem! Kaspersky Lab offers 30-day free trials for all their products.

The folks over at GFI Software gave us a big pile of codes for their awesome VIPRE Antivirus software to give out to you, our faithful Tom’s Hardware readers.  All you have to do is head over and “Like” Tom’s Hardware on Facebook for the coupon code that you can then redeem for a full version of the VIPRE Antivirus software.

If you’ve already Liked our page, find your code under the “Welcome” tab.  It’s good stuff, and was built specifically to ensure that it won’t slow your rig.  Our supply of codes is limited though, so get yours fast!

UPDATE: Last week as a perk for Liking Tom’s Hardware Facebook page, 2,500 of you got a free full version of the super-fast VIPRE Antivirus software and our supply of the codes was gone within the day.  Because so many have asked for a follow-up, the folks at GFI have agreed to an encore and have given us an additional 2,500 full free versions of VIPRE Antivirus that’s built so that it won’t slow down your rig.  Head over to Tom’s Hardware Facebook page and hit that Like button and get one fast while they last!

The Blame Game

Remember the days of Windows 98, when CPUs ran at triple-digit MHz speeds and slogged along with less than a gigabyte of RAM? Installing a resident program like a virus scanner often meant committing performance suicide. And heaven forbid a scheduled scan start up while you were actually at your desk. Productivity could literally grind to a halt. At least that’s how I remember things through the fog of time.

Today's personal computers are much more powerful than they were a few years ago, so perhaps the notion that an anti-virus application will still have a debilitating effect on performance is obsolete. Still, folks who began using computers after multi-core CPUs and gigabytes of RAM became the norm have likely never used a PC without a virus scanner installed. They'd have no way to relate to the days of running lean and mean to keep speed manageable. Now we have resources to spare. Cores sit idle, waiting for a task to execute, while low prices on memory make 6 GB and 8 GB kits affordable for even mainstream users.

We should make this perfectly clear: while it’s undeniable that an active virus scan can cause a heavy performance burden, what we’re really curious about is whether or not performance is affected when a system scan is not running. Does it take longer to open files when you have a resident virus scanner installed? Does the presence of the software tax CPU resources while you’re running other programs? What kind of tasks are most affected by security products, if any?

When faced with these sorts of questions, it’s only natural that we’d run some tests to unearth the real answers—this is Tom’s Hardware, after all. So let’s look a little deeper into quantifying the anti-virus conundrum.

What Does A Virus Scanner Do?

Before we begin our tests, we should at least consider how virus scanners work so that we can see if the results are in sync with our expectations.

There are two main mechanisms that most virus scanners use in order to keep your system safe: file checking and behavior monitoring.

File checking is by far the most prevalent technique. The idea is simple: the virus scanner examines the files on your PC for known threats, a threat being a signature of code that is associated with a particular virus. Because new viruses are being released all the time, most virus scanners will periodically download updates containing the new threat signatures.

How could file checking affect performance? Typically, a virus scanner will examine files for threat signatures every time a file is written, opened, closed, or emailed, or when a virus scan occurs. It thus makes sense to predict that applications accessing files on a regular basis might be slowed down by anti-virus software. Conversely, programs that don't involve a lot of file access might then remain relatively unaffected by the presence of a virus scanner.

Behavior monitoring is the second technology that anti-virus software employs to identify threats. This is a pre-emptive strategy to deal with viruses that have not yet been identified or added to the threat-signature dictionary. The virus scanner monitors the system for suspicious behavior, such as the alteration of executable files. This virus-prevention technique probably has very little effect on system performance, since suspicious behavior is probably somewhat rare.

That should be enough of a top-down overview to get us started. Let's get on with the tests!

Test System And Benchmarks

We begin by selecting the security software to test. We're curious to find out if Internet security suites might contain bloatware that could slow down a system more than a simple anti-virus program would, so we've included not only virus scanners, but also complete Internet security suites offered by noteworthy developers. This means we’re testing AVG Anti-Virus, AVG Internet Security, Kaspersky Anti-Virus, Kaspersky Internet Security, McAfee VirusScan Plus, McAfee Internet Security, Norton AntiVirus, Norton Internet Security, Trend Micro Titanium AntiVirus+, and Trend Micro Titanium Internet Security. [edit: we originally listed some obsolete versions of the AV software. The programs we actually tested were the newest available versions as of October, 2010]

Where benchmarks are concerned, we’ve assembled a suite of tests to exercise most aspects of PC performance, from gaming to office work. We’re testing raw application performance and also the time it takes for the system to respond to boot and to program launch requests. In order to do this, we’ve even developed some custom benchmarks, courtesy of our own Andrew Ku.

While we're running the benchmarks on an Athlon II X4 645, we'll be disabling two of the CPU cores for the majority of benchmarks. As a result, most of the benchmarks reflect the performance users can expect from a budget dual-core CPU. On page seven we run more benchmarks with only a single CPU core enabled, and also with all four CPU cores enabled, to see if the performance burden changes based on the number of execution cores available to the system.

With all this in mind, here are the particulars for our test system and benchmarks:

And here's a list of the benchmarks:

CPU And Game Benchmarks

We should preface the following CPU and game benchmarks by saying we really don't expect security software to have an effect on them. Anti-virus software typically activates on the creation, opening, closing, or emailing of files, and none of the following tasks are focused on any of these activities. Regardless, we make no assumptions and perform the following tests to check our theory.

We start things off with a synthetic CPU benchmark to see whether or not these products will cause performance differences compared to a computer without any security software installed. As you can see, the presence of this software appears to cause no tangible impact on raw processing performance.

Now let’s see what happens in a real-world encoding application.

Encoding a video with the Xvid codec definitely stresses the processor—in fact, it stresses the whole platform. Nevertheless, there’s no real performance difference to see here.

We benchmarked Crysis to see if any of these security software products would affect game performance. Happily, it does not appear to have any impact whatsoever.

File Access Benchmarks

The following benchmarks involve hard drive and file access, which a virus scanner could theoretically affect.

The results are close across the board with our first file access benchmark, the PCMark hard drive test score. It has been our experience that PCMark results have a larger margin of error than what we’d prefer, so we won’t draw any specific conclusions from this close result.

Moving to a real-world benchmark that involves compressing 334 MB of files, our WinRAR test doesn’t expose any obvious weaknesses in file system performance.

General Use Benchmarks

It can be difficult to define and measure the general responsiveness of a PC, yet the productivity and communications benchmarks that are part of the PCMark Vantage suite are probably well-suited for this test.

The PCMark Vantage communications benchmark includes a combination of tests that cover common tasks like data encryption, compression, Web page rendering, and Windows Mail searches. Past experience with PCMark shows that the margin of error can be a little larger than what we’d like it to be and the score with no security software running is actually lower than some results when virus scanners and Internet security suites are running. We consequently can’t draw any conclusions from these results, but can see that there isn’t a large difference when any of these products are used.

The productivity benchmark suite includes common tasks like starting applications, editing documents in WordPad, and searching contacts using Windows Search. There is a multitasking portion of this benchmark that runs three simultaneous tasks, including a Windows Contact search and Windows Mail message rules and renders numerous Web pages in Internet Explorer. Finally, this bench includes a number of hard disk stressing tasks, such as a Windows Defender scan and a boot timer.

As you can see, there are definitely some strong trends here that suggest this benchmark is affected by security software to varying degrees, but Kaspersky and Trend Micro products appear to suffer a large performance penalty.

Let’s dig deeper into the PCMark productivity benchmark specifically to see exactly what tasks are running slower when antivirus software installed:

Very interesting. First, let’s look at the productivity tasks that are not affected by the presence of these scanners. All of the hard disk-intensive tasks, such as Windows Vista startup, Windows Defender, and application loading, perform no differently with or without security software installed. This result supports our previous hard drive test results that also demonstrate little or no performance penalties due to a resident virus scanner. Aside from this, text editing a Word document also shows no performance differential.

On the other hand, a Windows Contacts search operation demonstrates a sizable performance penalty when Kaspersky or Trend Micro security software is installed. Note that the Productivity 4 Windows Contacts search occurs during multitasking, but both results are similar. The other operation that appears to be affected by the presence of security software is Web page rendering, also recorded during multi-tasking operations.

On a final note, we should mention that we left one of the PCMark productivity benchmarks out of the above chart. The Productivity 4 Windows Mail copying benchmark provides very inconsistent results in our testing, reporting anywhere between one and six operations per second.

Response Time Benchmarks

It is our intention to benchmark the boot time with these different security solutions installed, and we spent a lot of time testing this using GreenVantage’s WinBootInfo utility. Unfortunately, the results we recorded show a huge variance from 30 to 60 seconds, even when taken one after the other, and we’re not comfortable releasing these results even after averaging multiple iterations. What we will say is that all of the averages we recorded are between 32 and 46 seconds. With boot times ranging from 30 to 60 seconds, there probably isn’t any significant conclusion to draw.

The response time benchmarks we demonstrate below are much more consistent. We open a document in Word and a LAN-hosted Web page in Firefox. Here’s how long it takes, on average, to open these files the first time after a fresh boot into Windows:

While we do experience significant variance between minimum and maximum load times for each security software package, with six iterations averaged, we see some clear trends across Firefox and Word. Most notably, AVG, McAfee, and Trend Micro products seem to take a little longer to open files than their competitors. McAfee Internet Security, specifically, has a longer wait time to launch the test Web page.

Speaking of McAfee, with this product installed, we notice a colossal lag to launch the timer application we developed to record benchmark results. When I say colossal, I mean it takes the better part of 10 seconds to launch the tiny program—an application that executes instantly with any other anti-virus program we tested. The reason for this appears to be that McAfee’s real-time scanning method is based on checking against known application signatures. Since McAfee obviously can’t have signatures for custom-made applications, it will thoroughly scan the application in question before launch. It does seem to take longer than it should to accomplish this task. We’re asking McAfee about this and hope to have an answer before publication—otherwise, we will follow up in a future article.

Back to the results, though. The bar graphs do make it appear that there is a large variance on first load, but we’re talking about a two to five-and-a-half second spread to open Firefox and a three-to-six-second spread to open a Word document. It sounds worse than it feels, as those extra few seconds don’t seem all that obvious. Admittedly, that’s a subjective argument.

What is objective is that the same application loads much faster the second time it is launched during a Windows session:

The difference in application launch speeds is reduced to less than a second between competing security software solutions on subsequent runs of the same program. This is a short enough time span that it's difficult to notice any change at all during real-world use.

Single-, Dual-, And Quad-Core Benchmarks

We think it’s important to address one of the variables missing from our previous tests, and that is hardware. As we’ve seen up until this point, most applications don’t seem to show a notable difference in performance, regardless of whether security software is installed or not. But all of the tests have also been run on a dual-core CPU, too. Will the results change on a single- or quad-core processor?

We would expect the raw performance to drop slightly in multithreaded applications. But we're curious about the effect security software has on single-core performance, too. While we don’t have time to run the entire benchmark suite for different processor setups, we run all three CPU options with AVG AntiVirus 9, AVG Internet Security 9, and without any security software installed for a quick test:

While the number of available execution cores can certainly affect the raw results, when it comes to comparing performance on the basis of available compute resources, the only metric that shows a significant performance drop associated with a single-core processor running security software is the time it takes to load Internet pages on the first run. Aside from that, security software doesn’t seem to have an adverse affect on single-core PCs. This is a surprising result, as we expected security software to take advantage of threading. It’s possible that our test scenarios don’t give the software an ideal opportunity to do so, but it’s a surprising result nonetheless.

Conclusion: A Pleasant Surprise

As mentioned on the first page, I came into this story idea aware that I had a prejudiced expectation. Although I’d never actually tested it for myself, I was under the impression that the presence of a resident virus scanner would have an adverse effect on system performance.

I’m very happy to report that my preconceptions have no place in today’s PC world, as even single-core processors are able to demonstrate comparable performance with or without modern security software installed. This is true not only for basic virus scanners, but also for comprehensive security suites.

Having said that, it’s also true that the presence of security software isn’t undetectable in all circumstances. We do see an increase in application launch times with a virus scanner installed, but the only significant wait time is a couple seconds added on the first launch of a program. Subsequent launches appear to be cached, and the wait time is almost imperceptible.

The only benchmark that shows a notable performance decrease with a virus scanner installed is PCMark’s productivity suite. Even here the performance hit is only notable with two of the 10 tested security products, and in this case, an increase in Windows Contacts search times is the main cause. While I can’t speak for everyone I know, I do not spend a significant amount of time searching Windows Contacts, so for me this isn’t much of an issue.

While these results are encouraging, a couple of questions need to be answered. As we mentioned at the beginning, we’ve limited our testing to performance with the virus scanner installed. However, what is the performance hit during an actual virus scan? This is something we hope to examine in a follow-up review in the near future.

However, for the time being, we’ve learned that a user can confidently install a virus scanner or Internet security suite without being too concerned about performance consequences. It appears that typical tasks we undertake when using our PCs will not be notably slowed by the security software on which we rely. In the end, I’m pleased to admit that my expectation of a decrease in general PC performance when a virus scanner is installed was incorrect and obsolete.

Intel this morning released a statement announcing its acquisition of software security company McAfee at a cost of $48 per share, or $7.68 billion. McAfee, which last year brought in more than $2 billion in revenue, has more than 6,000 employees and will operate as a wholly-owned subsidiary, reporting into Intel’s Software and Services Group. Intel CEO Paul Otellini said in a statement that the company now ranks security among its top three priorities, along with connectivity and energy-efficient performace.

"With the rapid expansion of growth across a vast array of Internet-connected devices, more and more of the elements of our lives have moved online," said Paul Otellini, Intel president and CEO.

"In the past, energy-efficient performance and connectivity have defined computing requirements. Looking forward, security will join those as a third pillar of what people demand from all computing experiences. "

Renée James, Intel senior vice president and general manager of Software and Services, said the acquisition will lead to breakthroughs in the security market.

"Hardware-enhanced security will lead to breakthroughs in effectively countering the increasingly sophisticated threats of today and tomorrow," said James.

"This acquisition is consistent with our software and services strategy to deliver an outstanding computing experience in fast-growing business areas, especially around the move to wireless mobility."

"McAfee is the next step in this strategy, and the right security partner for us," she added. "Our current work together has impressive prospects, and we look forward to introducing a product from our strategic partnership next year," he added.

Both boards of directors approved the acquisition, which will be complete once it is approved by McAfee shareholders, and the various different regulatory bodies that have to give these kinds of deals the once over.

Check out the full press release here.

On Wednesday, security software provider McAfee pushed out an updated DAT file that deleted the svchost.exe file, which then triggers a false-positive in McAfee itself. This affected tens of thousands of business computers.

McAfee quickly released a fix, which can be now found here. Barry McPherson, executive vice president of support and customer service, issued the apology on behalf of McAfee in a new company blog post.

Of course many of you are asking how the faulty DAT made it past our quality assurance checks. The problem arose during the testing process for this DAT file. We recently made a change to our QA environment that resulted in a faulty DAT making its way out of our test environment and onto customer systems.To prevent this from happening again, we are implementing additional QA protocols for any releases that directly impact critical system files. In addition, we plan to add capabilities to our cloud-based Artemis system that will provide an additional level of protection against false positives by leveraging an expansive whitelist of critical system files.Again, on behalf of McAfee, I’m very sorry for how you may have been impacted by the faulty DAT file update and thank you for your continued support and cooperation as we work to remediate the situation.

A bad update issued today for McAfee for Windows XP is causing computers worldwide to shutdown and sent itself in a loop of restarts. Engadget received the following statement from McAfee regarding the continuing incident:

McAfee is aware that a number of customers have incurred a false positive error due to incorrect malware alerts on Wednesday, April 21. The problem occurs with the 5958 virus definition file (DAT) that was released on April 21 at 2.00 PM GMT+1 (6am Pacific Time). Our initial investigation indicates that the error can result in moderate to significant performance issues on systems running Windows XP Service Pack 3. The faulty update has been removed from McAfee download servers for corporate users, preventing any further impact on those customers. We are not aware of significant impact on consumer customers and believe we have effectively limited such occurrence. McAfee teams are working with the highest priority to support impacted customers and plan to provide an update virus definition file shortly. McAfee apologizes for any inconvenience to our customers

The story is that the DAT update 5958 deletes the svchost.exe file, which then triggers a false-positive in McAfee itself. Early estimates say that this has affected between 30,000 to 60,000 machines so far.

This week there's been an awful lot of talk about free antivirus. Between Microsoft officially launching its Security Essentials software and Symantec essentially saying free antivirus sucks, there's been no shortage of differing opinions on the matter.

Microsoft isn't the first to offer free antivirus. MSE aside, you've got Avast and AVG, software that many of you say you use and much prefer over the likes of Norton or McAfee. That said, most of you know your way around the web and wouldn't be clicking on the big, blinking signs that say you've just won a cruise to the Caribbean or seven billion dollars in stock options.

Today's question of the day is do you think free antivirus is enough for the average computer user?

The Redmond-based company pushed out a beta of Microsoft Security Essentials in June, making the software available to users in the United States, Israel (English only), People's Republic of China (Simplified Chinese only) and Brazil (Brazilian Portuguese only). However Bob Muglia, the president of Microsoft's server and tools division said that the tool will be available for everyone today.

Formerly known as Morro, Microsoft Security Essentials endeavors to provide basic protection from various types of malicious software, including trojans, spyware, viruses and even rootkits. Following today's launch Microsoft will completely discontinue OneCare, the company’s current security software that it released three years ago.

While Microsoft's offer of a free security suite that requires no registration, trial or renewal sounds like something that would have competitors worried, it seems major rivals are unfazed by the product. When the Beta launched, neither Symantec nor McAfee batted an eyelid.

Janice Chaffin, Symantec's Consumer division president, said that Morro is basically a stripped down version of OneCare. "A full Internet security suite is what consumers require today to stay fully protected," she told Reuters when news of the software broke this past summer. McAfee said it remained confident in its ability to compete with "anyone who might enter the marketplace."

Download MSE by visiting the download page here and be sure to let us know what you think.

A lot of Apple fans boast about how their computer might be expensive, but at least they don't have to bother with any antivirus or malware protection. However, it seems those days are over as Apple has added malware protection to the latest version of its OS, OSX 10.6 or Snow Leopard.

First reported by Intego, the Register reports that the protection was quietly added earlier this month to build 10A432, which is the most recent build of Snow Leopard. However, the Reg goes on to cite a source that said the functionality was included in 10A421a, a much earlier build.

The feature is said to warn users if they try to install applications known to be malicious. However, according to the Register's anonymous source, it's quite limited; for one, it's only checking for two known Mac trojans, and two, it only flags those files if they were downloaded from the internet using Entourage, iChat, Safari, and a handful of other applications.

It might not be much, but it's definitely a step away from the belief that Mac users don't have to worry about viruses.

Image Credit: Intego

The company pushed out the beta of Microsoft Security Essentials yesterday, making the software available to users in the United States, Israel (English only), People's Republic of China (Simplified Chinese only) and Brazil (Brazilian Portuguese only).

Originally codenamed Morro, Microsoft says the software will provide protection from from viruses, spyware, rootkits, and Trojans for users running Windows XP, Windows Vista, and Windows 7. InformationWeek describes MSE as essentially the anti-malware component of Microsoft's subscription security service, Windows Live OneCare, without the utility applications and the $50 annual fee. Microsoft announced in November that it would discontinue OneCare Live in order to focus on a product that would better serve consumers.

A full release of the software is scheduled for the fall, around the time Windows 7 goes to retail. No word on whether or not Microsoft will be poking the anticompetitive bear by bundling Microsoft Security Essentials with Windows 7. Until then, anyone planning on trying out the beta? Let us know!

Formerly known as Morro, Microsoft Security Essentials endeavors to protect the end-user from various types of malicious software, including trojans, spyware, viruses and even rootkits. Once the final version launches, Microsoft will completely discontinue OneCare, the company’s current security software that it released three years ago.

CNet reports that the software will run on Windows XP, Vista, and Windows 7, will be available in the U.S., Brazil, and Israel in English and Brazilian Portuguese, adding that a public beta version for Simplified Chinese will be available later in the year. Alan Packer, general manager of Microsoft's Anti-Malware team, told the site in an interview that the company doesn't see the software as a direct competitor for other free products. "We don't see Security Essentials as a direct competitor to other free products and suites," said Packer. "We're targeting people who aren't protected" already.

Both Symantec and McAfee seem unfazed by Microsoft's free protection, and even referred back to OneCare. Janice Chaffin, Symantec's Consumer division president, said that Morro is basically a stripped down version of OneCare. "A full Internet security suite is what consumers require today to stay fully protected," she told Reuters when news of the software broke last week. McAfee is remaining confident in its ability to compete with "anyone who might enter the marketplace."

What kind of antivirus do you run, and would you be willing to give Microsoft Security Essentials a shot? Let us know in the comments below!

The malware is believed to be the Neeris worm. Several reports indicate that the problem was caused by the U.S. Marshals Service running backlevel antivirus software, Trend Micro’s OfficeScan v5.0, as well as not applying patches to its computers.

Neeris targets unpatched computers in the same way the Conficker worm does. “Neeris and Conficker look for missing patches. If the PCs and servers are patched, the malware doesn't work,” John Pescatore, research director and vice president at Gartner, told SCMagazineUS.com. However, Pescatore added that, “The patch for this has been out since October 2008.”

SCMagazine reports (citing USMS spokesperson, Nikki Credic) that when the virus was discovered, IT staff disconnected the marshals' computers from the Justice Department's network to prevent further spread. The marshals' internet connection was shut off all day Thursday, added Credic with only internal email operational.

The FBI were similarly affected. "We too are evaluating a network issue on our external, unclassified network that's affecting several government agencies," FBI spokesman Mike Kortan told the Associated Press. Kortan reportedly did not elaborate on the situation, nor did he identify the other agencies.

Read the full story from SCMagazine here.

Earlier today, Panda Security--publisher of Panda Antivirus and Panda Internet Security--announced the global beta release of the industry's first free cloud-based antivirus "thin-client" solution. Called Panda Cloud Antivirus, the company said that the new technology offers 50-percent less impact on PC performance when compared to installed signature-based antivirus programs. Currently the service is still in its beta stage, however consumers can download a free, "thin" client from the official website; the service will remain free to use once the service leaves the beta stage.

According to the company, the new service uses Panda's "proprietary" cloud computing technology called Collective Intelligence. Cloud computing, at least in this case, could be defined as "grid" computing, utilizing thousands, even millions, of user-based PCs to create one very big computer. Panda's technology takes advantage of its global community (consisting of "millions of users) to identify and classify malware strains. Each file received by Collective Intelligence is automatically classified in under six minutes; the servers currently receive and classify over 50,000 new samples every day. The overall result is an online, real-time database that stores the majority of signature files in a virtual "cloud" rather than places them on end-user PCs. For this reason, because of the level of end-user input, Panda decided to offer the service for free.

 "Every Panda user is a sensor for new malware, sending statistical data about malware prevalence back to the cloud," the company said. "This new approach reduces bandwidth consumption on customers’ PCs and provides faster and more comprehensive up-to-date protection."

Why is this better? Because installed antivirus programs--typically from Symantec, McAfee, CA--inserts multiple programs into the operating system that intercept files at different layers and scans them with various components. This not only consumes unnecessary amounts of memory, but can bog down the CPU to the point of utter annoyance, or as Panda states, "negatively impacting performance." The Panda Cloud Antivirus client doesn't install multiple tentacles, consuming an average of 17 MB of RAM; the downloaded client itself weighs only around 18 MB, and installs around 50 MB onto the hard drive. Thus, the system provides a lightweight way to detect viruses, malware, rootkits, and heuristics in a non-intrusive way.

The biggest advantage however, is being constantly updated with the latest virus definitions from the cloud, rather than locally on the system.

“We truly believe that Panda Cloud Antivirus represents a quantum leap in protection over the traditional approach to antivirus architecture,” said Juan Santana, CEO for Panda Security. “Panda Cloud Antivirus offers consumers a truly install-and-forget solution that delivers the industry’s fastest protection against the newest malware with literally half the performance impact. We’re excited to make it available today for free, which is Panda’s way of paying back to the community and growing our Collective Intelligence network so that we can deliver even greater protection to all customers.”

According to Pedro Bustamante, senior research adviser at Panda Security, the Cloud Antivirus program will continue to work even if the PC isn't connected to the Internet. "The model we've implemented is to break down the traditional antivirus to client and server, so when the user is not connected they keep a local cache copy of Collective Intelligence, including detections for what Collective Intelligence sees is spreading through the community," he told CNET. He also stated that the service would remain in beta for a while as it builds its user client base, however he hopes that it will leave the beta stage by the end of the summer.

Currently Panda Cloud Antivirus can be used on Windows XP and Windows Vista platforms, and will also be compatible with Windows 7 when the operating system eventually ships. Come, join the Collective. Resistance is futile.

In recent months news, about the Conficker worm has come in a steady stream and in the last few weeks people really began to worry about what might happen on the first of April this year.

The latest estimates suggest that the Conficker virus has spread to up to 15 million machines. F-Secure said last week that so far, Conficker has been polling 250 different domain names every day to download and run an update program. On April 1st, the latest version of Conficker is supposed to start polling 500 out of 50,000 domains a day to do the same thing. If this is true, those millions of computers should be doing something by now and they are, kind of.

We were skeptical about the Conficker virus from the beginning and while we did our best to keep our hair on about the whole affair, we couldn’t help but feel a glimmer of anticipation at the thought that something might happen. Despite being fast asleep by midnight, when the sun rose this morning, we woke up unharmed, as did our computers. According to an F-Secure post, Conficker has activated but so far, nothing has actually happened. Go figure.

“Infected computers use the local time as the trigger to start generating the list of 50,000 domains, so in places where the local time is already April 1st, these computers are now actively polling for domains.

And, until the GMT date is April 1st they are in fact polling for domains for 31st March. So far there hasn't been any updates available on those sites.

In summary: Conficker has activated. So far nothing has actually happened.”

Obviously, we’ll be keeping you posted on this one, but we’re not chewing our nails down to the nubs just yet. Yes, it’s doing something, but nothing of consequence, yet.