Norton Internet Security 2007 - Far from a Drag

Norton security products are widely used, popular security solutions. The "Norton" name derives from Peter Norton who began developing software for the PC back in the days of DOS. Over the years, the brand has matured and, if Wikipedia is to be believed, Norton Internet Security has become Symantec's flagship product. I reviewed version 2007 of the software, though version 2008 was released in August of 2007.

I had some expectations, many of them poor, coming into the review. There has been a lot of press regarding the drag Norton Antivirus can be on systems and if you read a lot of troubleshooting websites, many times Norton products are at the root of connectivity issues. "Turn off Norton" is a popular recommendation of many network experts giving advice to frustrated newbies. I expected a bloated, sluggish (though visually appealing) package of software. I was pleasantly surprised. Not only is Internet Security not bloated (at least in terms of its runtime engines), but in modest testing I did, I encountered a negligible drag on the CPU. And, Norton Internet Security is easy on eyes.

Installation went smoothly and actually turned out to be one of the least annoying processes of the many security package installations I've tested. Uninstallation was smooth but didn't do a good job of cleaning up after the installer. Likewise, the product performed well in my testing. I did some semi-formal tests performing everyday tasks as well as doing informal testing (like playing music over a network with the scanners on). Norton performed well overall. The only noticeable performance impact was in the browser. Opening and closing Internet Explorer was detectably slower.

The feature set is broad and the Symantec engineers did a good job of designing the UI. The product includes one of the better firewalls I've tested, though I found the interface and options a bit too complex for the casual user. The antivirus and spyware utilities are easy enough to use and come with all the features one would expect from world-class software. The user interface hides the complexity at the surface but provides interfaces that will allow you to tweak to your heart's content. It was easier to get lost in Norton's interface than it was, say in the BitDefender product. This partly has to do with the depth of the features. But there were places where clicking on a link brought up a box with buttons where clicking one of the buttons brought you to a screen with more links, and so on. So, while the product is well endowed, it also may be too much for the casual user to handle. Power users will be thrilled. Help and support is solid with both online and offline help and context-specific guidance in key parts of the UI.

What's Hot: 
Norton Internet Security is a professionally engineered software package that is chock-full of features. A top-notch firewall and beefy virus and malware scanners highlight this package. The user interface is excellent and the memory footprint is small.

What's Not: 
For the money, most casual users can get almost as much for about half the price. If you're just looking for a basic security package, Norton Internet Security will be too much software for the money.

What's Hot: 

Installation was seamless and painless. I used the installation option that downloads the product from the Internet. This was a nice choice because the URL to the download that Symantec sends includes the registration number, so I didn't need to enter that during the installation process. The installer downloaded and started without issue. The installer will scan for "risks" prior to installation. The stated purpose of the scan is to detect issues that might hinder the software from being installed. Some viruses will prevent virus software from being installed or will shut down running virus scanners so this "pre-install scan" is a good thing.

By default, Internet Security utilizes a separate toolbar for status and options rather than placing an icon in the system tray. The only reason I could see for such a move is that it gives Symantec more space to display a rather large "Norton" on your desktop. Otherwise, it functions like a system tray icon would. Clicking it brings up the user interface for the application; right-clicking brings up an option menu. You can choose to close the toolbar and display status in the system tray by choosing that option from the right-click menu.

What's Not: 

Unlike most of the installers for the other security packages I've tested, the Norton installer did not require a lot of handholding. I counted only two dialog boxes that needed input from me. Other than that, the installer ran on its own (I'm not including the obligatory registration wizard here.)

The registration wizard does not have a Cancel button and disables the corner close button. Here's a trick: if you want to skip registration, click Next twice without valid information and the dialog box will produce a Skip button that allows you to bypass registration. Shame on you ,Symantec.

The Norton Internet Security installer writes roughly 350MB to your hard disk and just shy of 1600 registry keys. The uninstaller can be run by relaunching the installer. The uninstaller left about 50MB on the system and all but 63 registry keys (though it did delete more than half of the values in those keys). The uninstaller should do a better job of cleaning up.

What's Hot: 

Norton Internet Security is a well-rounded package that includes anti-virus and anti-spyware protection, a firewall, email and IM protection, a phishing filter, and intrusion protection. If you don't know what one of these do or how they protect your computer, each item in the Norton Protection Center tab has a Learn More link that takes you to the Symantec website, where you can get schooled in basic security principles related to the link you clicked. Each of the features included in the package can be customized.

The firewall seemed adequate, though at first I could not get it to warn me about anything passing through it. I discovered that this was because Symantec seems to have erred on the side of liberty when it comes to the default settings. With other packages I've tested, the firewall defaulted to a locked-down state tighter than Simon Cowell's smile--I couldn't copy a file without getting stopped in my tracks. Norton's package, however, had program launch detection, program component monitoring, and user prompts off by default. The application defaulted to enabling Norton as the decision-maker.

For my part, I thought this was a refreshing change. I install security software that I want to work well but be relatively invisible. I don't want to be warned or notified about every little thing. I'd rather have the software I paid for do the work it's supposed to do, so I can do the work I'm supposed to do. To have your security package warn you about every potential threat or to ask you for your permission to run a program or browse to a website would be like hiring a security guard and having her come to you when a squirrel runs across the lawn or quizzing you about when you want to leave the house. A security package worth its salt should be able to determine when a threat is grave enough to get you involved. Otherwise, it should do the work you paid for it to do.

What's Not: 

Norton Internet Security installs a toolbar into your web browser that allows you to manage phishing threats. It allows you to see, instantly, whether a site is a possible fraud and allows you to report the site right from the toolbar. Modern web browsers like Firefox and Internet Explorer come with their own phishing filters, so having the native filter and Internet Security's filter on may be overkill and could affect performance.

I did run into an issue with Internet Security's firewall. I have a rather odd setup on one of my workstations (the one on which I do much of my testing). I have a regular network card that is connected via hardwire to a hub connected to the Internet. I also have a PCI wireless network card in that machine that is connected to a separate network and is not connected to the Internet. Internet Security's firewall manages network interfaces partly by "trusting" them.

A trusted network interface is one that the firewall will allow data to pass through. My network card was automatically trusted after I installed Internet Security. My PCI wireless interface--which I installed after Internet Security-- was not, however. I was having trouble seeing shares on my network when I finally decided to explore Norton's firewall. I found that the wireless card was not on the trusted list and as soon as I added it, everything was happy. Well almost.

I use the wireless network card to connect to a server in my living room (yes, my wife hates it) that stores the music for our home. Without access to that server, I can't listen to music in my home office. After I restored access I was happily listening to tunes, when halfway through an Alanis Morissette song, the network connection quit. Suspecting the Norton firewall, I investigated and found that due to a minor change I made to the wireless card's network settings, the firewall saw it as a new connection and didn't add it to the trust list. The old connection was still there but since it was no longer associated with the card, it wasn't being used to manage network connectivity as far as the firewall was concerned.

The package detected and stopped the virus in the Eicar test file.

What's Hot: 

I ran some non-scientific tests to evaluate whether the scanning software would cause obvious and immediate problems with basic tasks like browsing the Web and copying files. I wrote a small software program that would precisely time these operations. I ran a first set of tests without the software installed and running, and a second set with Internet Security running in the background with all scanners turned on. For the first test, I copied five 21MB files over my home network from the local machine (on which Internet Security would be installed) to a network share. The second test copied 300 8K files over the network. I was testing to see if smaller files, and more of them, would affect the scanners negatively. Finally, my program went to five major websites (with complex layouts) and downloaded their home pages. I ran each test five times on a 2.2GHz Celeron machine with 1GB RAM and Windows XP SP2 with all the latest service packs. Here are the results:

No Scanners
Large files: 17439 ms
Small files: 3690 ms
Websites: 5846 ms

Scanners
Large files: 17944 ms
Small files: 4869 ms
Websites: 5980 ms

While the scanners did impact the overall performance for these basic tasks, the impact was negligible. The largest hit came when copying lots of small files over the network--which is to be expected. Compared to other packages I've tested, the Symantec package performed above average.

What's Not: 
As with all software that runs full time on your system, I recommend that you try, if possible, the software first in your own environment, doing the things you normally do, before making a purchasing decision. Environmental factors play a big role in how software like this performs in the real world.

What's Hot: 
Symantec uses a blend of offline and online help to assist the user in the event of problems. I believe having an offline help solution is important in a security package in case of Internet connectivity problems (particularly due to a virus or malware). The help I used was context-sensitive (gave me information relevant to the feature I was using) and adequate enough to get me through any minor issues or knowledge gap.

Norton Internet Security offers some online integration, but it could do more in this space. Also, many packages are moving to a model where the security software and reporting for all computers on a home network can be managed from a single machine. Symantec needs to do more in this area if they want to keep up.

Norton Internet Security is a solid, well rounded, security application. Based on the results of my tests, it would seem that the engineers at Symantec have addressed many of the issues that had plagued the software in earlier versions. The granular features are not for the faint of heart and users who want a basic security suite could save a little money by going with another package. Still, it will be hard to find a better package with more to offer.

McAfee VirusScan Plus, BitDefender AntiVirus, Trend Micro PC-cillin, Microsoft OneCare