Trend Micro AntiVirus Plus - Infected with Bugs

Given that the product doesn't perform as advertised--it failed to detect a virus--it's not worth installing at any price. You can spend your $40 on another product that offers more, with much higher quality.

The help and support area for this product is very well done. The Help & Support button allows you to launch the local product help, a CHM (Microsoft Compiled Help) file for local, fast, indexed help, as well as launch the online support and knowledge base.

The standard InstallShield installation went smoothly. The installer did scan for viruses prior to installation. [trend_micro_install_scan.JPG]

Unlike other packages, it did not attempt to download updates and did not require a reboot. [trend_micro_install_finish.JPG].

Because the installer didn't update the virus signatures, Windows Security Center immediately detected that the signatures were out of date and recommended that they be updated. [trend_micro_install_security_center_update.JPG]

After uninstalling and reinstalling, the second installation attempt produced an "Install Failed" box, but appeared to install correctly. [trend_micro_install_install_failed.JPG]

The installer wrote 85 MB to the disk and created 145 registry keys. The uninstaller left 2 MB and 32 registry keys on the system.

Once inside Trend Micro AntiVirus, I was prompted to update the virus signatures. Clicking the update button alerted me to the fact that a new, 41 MB security update was available and asked me if I wanted to install it. [trend_micro_install_update.JPG]

Clicking Yes downloaded and installed the update. The whole process took quite some time. The Update Progress dialog box said it would take a little under three and a half minutes, but it took considerably longer. The updater appeared to have problems downloading the update. [trend_micro_install_update_progress.JPG]

When the update download and installation completed, the dialog box went away and I was given no further feedback.

Trend Micro offers basic virus and spyware protection tools. This package does not include a firewall or much in the way of  integration between tools and online services. The tools include the functions you'd expect: scheduled or on-demand scanning, real-time scanning, and automatic updates. There aren't a lot of extras, but the product has the features one would expect in a modern security suite.

Overview
The user interface, while not necessarily poor, suffers from a lack of refinement present in other security offerings. Inconsistencies and oddities abound. The UI certainly is usable, and most users are unlikely to notice the design flaws. But they are present, and I think using the UI over time will get tiresome.
 
Trend Micro AntiVirus Plus Anti-Spyware uses a combination button and tab interface. The main application breaks the UI into four main areas: Overview, "Virus and Spyware Controls," Other Settings, and Help & Support. These are rendered as buttons. Clicking any of the buttons turns it into a tab of sorts that links it to the main content area. Inside the main content area for each button, users can modify settings and view information. The product designers decided to manage some of the content areas (specifically "Virus and Spyware Controls" and Other Settings) by the use of "expandos." When the button is first clicked, the expandos are collapsed and the user sees only the heading for that content area. Clicking the expando reveals the information and/or settings available for that subcategory. Unfortunately, clicking an expando closes any other expando you might have open, so you're only allowed to have one expando open at a time. [trend_micro_main_application_expando.JPG]
 
The software is implemented in a rather odd way with regards to the window frame (the dialog box) in which it sits. When the main application window first appears, it seems as if the red bar across the top is the title bar of the window. It has minimize and close buttons off to the right, and no menu bar like a standard window. [trend_micro_main_application_title_bar_1.JPG]

Next to the minimize button is a small, round button with two arrows. Clicking that reveals the "rest" of the window. [trend_micro_main_application_title_bar_2.JPG]

It also produces a menu bar with File, Operation, and Help menus. From a UI perspective, this is bad practice: the user now sees two close buttons and two minimize buttons which both do the same thing. The UI designers should hide the secondary close and minimize buttons when the others are exposed.

Turning the scanners off and on exposes another oddity. The taskbar icon gladly allows users to turn the scanners off with a single click (sadly, there is no timer to turn the scanners back on automatically). However, Protection Against Viruses is the only option that can be enabled or disabled. Opening up the main UI reveals why. Under the "Virus and Spyware Controls" area, there are two expandos: one entitled Protection Against Viruses and the other entitled Protection Against Spyware. Each expando contains a drop-down menu that allows the user to turn the virus and spyware scanners on and off, respectively.

However, while it's possible to turn the spyware scanner off and leave the virus scanner on, it is not possible to turn the virus scanner off and leave the spyware scanner on. Turning off the virus scanner also turns off the spyware scanner. To further complicate matters--and again, odd from a UI design perspective--when the virus scanner is turned off, the option box for the spyware scanner disappears! [trend_micro_main_application_spyware_off.JPG]

Top UI designers will tell you that not a best practice to have UI elements like these disappearing and reappearing based on another event in the UI. Best practice here would be to disable the spyware option box. Regardless of the behavior of the UI, it seems odd that the spyware scanner cannot be operated fully independently of the virus scanner. This makes for a poor user experience.

I ran some non-scientific tests to evaluate whether the scanning software would cause obvious and immediate problems with basic tasks like browsing the Web and copying files. I wrote a small software program that would precisely time these operations. I ran a first set of tests without the software installed or running, and a second set with VirusScan Plus running in the background with all scanners turned on. For the first test, I copied five 21 MB files over my home network from the local machine (on which AntiVirus would be installed) to a network share. The second test copied 300 8K files over the network. I was testing to see if smaller files, and more of them, would affect the scanners negatively. Finally, my program went to five major websites (with complex layouts) and downloaded their home pages. I ran each test five times. Here are the results:

Test 1
Without scanners: Average transfer time of 16004 ms.
With scanners: Average transfer time of 27479 ms.

Test 2
Without scanners: Average transfer time of 4882 ms.
With scanners: Average transfer time of 9431 ms.

Test 3
Without scanners: Average transfer time of 5391 ms.
With scanners: Average transfer time of 6412 ms.

The AntiVirus scanners performed abysmally. Copying the large files, the scanners added over ten seconds to the process and the time more than doubled copying the smaller files. Users who spend a lot of time working with files will definitely feel the presence of these scanners. For those users interested in Trend Micro AntiVirus for whom performance is a concern, I recommend downloading the trial version and testing the product in a real-world environment before committing.

One noteworthy item is that the Trend Micro scanners took up a somewhat large 56 MB of RAM while running, while the "protection service" took another whopping 82 MB of RAM. That's approximately 138 MB total memory consumed (full time) to have Trend Micro AntiVirus running on your computer. That's a lot of memory to commit for any user. Users without a lot of extra RAM to spare should seriously consider this when making a purchase decision.

Unfortunately, Trend Micro AntiVirus failed to detect the virus in the Eicar test file. All other scanners I've tested detected the test file without issue. But AntiVirus allowed me to download the virus to my machine without warning or quarantine. I rebooted the machine to ensure that there wasn't some anomaly with the scanning engine. Upon reboot, my network adapter failed to connect to the Internet. After some troubleshooting (including uninstalling and reinstalling the network adapter), I ran Microsoft's network diagnostic tool. It discovered a problem with something called a layered service provider (LSP) and the LSP causing the problem was Trend Micro's. [trend_micro_network_connectivity_problem.jpg]

The diagnostic tool removed the LSP and rebooted my machine, which returned network access. I suspect the reason AntiVirus failed to detect the virus had something to do with a failure of this LSP. According to AntiVirus' user interface, all the scanners were running and operating properly. If the issue was the LSP, the AntiVirus engine wasn't aware of the problem.