CyberScrub AntiVirus Lifetime - Simple or Scant?

CyberScrub AntiVirus Lifetime Edition installer does double duty. It functions as an installer and a setup wizard so be prepared to offer guidance and answer questions all along the way. Setup was smooth and the screens were clear at all but one point. The package I downloaded and used for installation required me to understand and agree that I should not reboot my computer while the installer was running and that all other virus scanners were shut off. I could not continue with the installation without acknowledging this.
[cyberscrub_install_oddwelcome.jpg]

Further, I had to input my serial number during the installation phase before the installer would continue. I rather like this approach. If an application is going to require a serial or registration number to run, I'd rather have it ask during the installation before it copies files to my hard disk. Oh, and CyberScrub, you might want to lose "okay man" (see the screenshot to see what I mean).
[cyberscrub_install_cantinstallreg.jpg]

Throughout the installation, you're asked to set a default security level (it's unclear if you're setting the level for the runtime scanners or the full scanners that run on a schedule), set an update schedule, and set a scan schedule. You're also asked to install the Kerio firewall.
[cyberscrub_install_schedupdte.jpg]
[cyberscrub_install_securitylevel.jpg]
[cyberscrub_install_keriofirewall.jpg]

The installer did tell me that the Kerio firewall would be prompting me several times as it goes through it's "learning mode." I appreciated this because it communicated that the several popups I'd have to clear  would be temporary and prepared me for what I would experience when the firewall launched.

The installer wrote about 45 Mb to my system and created approximately 275 registry keys. The uninstaller appeared to take off only 14 Mb of what the installer put on and deleted only nine keys (though this snapshot was taken prior to a reboot).

The interface for the Kerio Personal Firewall is much more traditional. Two of the three mail UI screens for the firewall can be loaded from the taskbar icon which will also provide functionality to stop all network traffic, change settings, and load help. The UI for the firewall consists of a status screen, the firewall configuration screen, and the administration screen.

The status screen is unique in that it provides a snapshot in table form of real-time data which includes all currently running programs and the number of bytes travelling across the network at any given time. It also supports filtering so users can block out data that is not relevant for them. It's one of the better views of this type of data on any of the firewalls I've tested. (I've flattened a couple of the columns in the screenshot for privacy reasons.)
[cyberscrub_firewall_main.jpg]

The configuration interface displays existing firewall rules and allows users to remove rules or add new ones. Existing rules can be disabled by un-checking a box. The UI also includes tabs that support Microsoft Network specifically and the ability to check an application's MD5 signature (which is used to verify that a file has not been modified).
[cyberscrub_firewall_config.jpg]

I found the interface for adding rules to be a bit cumbersome and counter-intuitive (uses too much jargon for the average user) but powerful enough. It took me a minute or so to add a rule for Remote Desktop Connection.
[cyberscrub_firewall_filterrule.jpg]

Of all the security packages I've tested, CyberScrub AntiVirus Lifetime Edition certainly has the most unique and modest UI. The main UI for CyberScrub AntiVirus Lifetime Edition is a small, futuristic-looking control panel that would look more at home in a Transformers cartoon than it does on a business machine. That is not to say the UI is poor. I actually like it. The colors (dark purple and dark teal) work and the interface is simple and clear. The application is one that you could leave open on your desktop and not mind that it's there. Of course there would be no reason to have it open as the UI provides no useful information and very little functionality that you would use on a regular basis. It really offers only two primary functions: (1) it allows you to change the security level (which you would only do once or twice, ever) and (2) to start a scan. It also allows you to launch help, reports, and the updater. But since the scanner and the updater can be scheduled, these functions are almost superfluous.
[cyberscrub_ui_main.jpg]

Customizable options for the user can only be described as "sparse." You're able to set the updates and system schedule and launch the support page (which is not local) and that's about it.
[cyberscrub_ui_options.jpg]

The Kerio Personal Firewall is, in many ways, a more robust package than the virus scanner. As a firewall, it's robust, aggressive, and provides a generally highly usable interface with some great views into network activity. (For example, the taskbar icon flashes with a green arrow when the computer is attempting to access resources on another network. If flashes with a red arrow when another computer is attempting to access resources on the computer on which the firewall is running. This is unique and, I found, handy.) The administrator interface uses a slider that allows for a quick adjustment of the permission level of the firewall and supports options like automatic update for its components and zoning (the ability to set secure or insecure zone that allows or disallows any traffic from that zone).
[cyberscrub_firewall_admin.jpg]

Before setting any options, I did find the firewall too aggressive. I must have cleared over 30 warning boxes after the firewall was started. It prompted me multiple times, for example, when trying to access a single internet site. This was partly because the warning box includes a checkbox that, when checked, will cause CyberScrub to create a rule for a given type of access. If this box is not checked, CyberScrub will continue to prompt you for the same event type until that event is no longer occurring or you check the box on the alert dialog. It was definitely the most aggressive warning system of the firewalls that I've tested.
[cyberscrub_firewall_alert.jpg]

There are two things that redeem this level of user dependence (which I typically eschew). First, the user is warned during the installation that there is a "learning phase" where the firewall will ask a lot of questions while it learns what should be allowed and what shouldn't. Second, the ability to set up zones really reduced having to give permissions to specific types of network events as the zone encompassed a host of events that would normally need individual permission. Still, the constant prompts were annoying and more could probably be done during setup or through built in intelligence to alleviate this.

The biggest downfall of the firewall is the performance. See the "Performance" section of this review for details.

The virus scanner caught the compiled version of the Eicar test file (the .com file). It asked if it should delete the file when I tried to download it. I said yes and was taken back to the download prompt. I clicked yes to download the infected file but was told that it had been removed. The scanner did not detect the text file which appeared in my browser window (a file other scanners did catch).
[cyberscrub_firewall_eicar.jpg]

I ran some non-scientific performance tests with the goal of determining whether CyberScrub AntiVirus Lifetime Edition would cause an immediate and noticeable decrease in basic file and web operations. In order to accurately test these operations, I wrote a small software program that would precisely time specific processes that an average user may perform on a daily basis. For the first test, I copied five 21MB files over my home network from the local machine (on which CyberScrub would be installed) to a network share. The second test copied 300 8K files over the network. I was testing to see if smaller files, and more of them, would affect the scanners negatively. Finally, my program went to five major websites (with complex layouts) and downloaded their home pages. I ran each test five times on a 2.2Ghz Celeron, 1Gb RAM, Windows XP SP2 with all the latest service packs. Here are the results:

No Scanners.
1. Large Files: 17350 ms.
2. Small Files: 5695 ms.
3. Web sites: 5793 ms.

Scanners.
1. Large Files: 17557 ms.
2. Small Files: 6884 ms.
3. Web sites: 9825 ms.

With the scanners running, performance was affected and at points dramatically. The first time I ran the large file test, the first transfer took over 50 seconds and the others were in the 17 second range which brought the average well above the 17 seconds you see in my results. I reran the test and the results were more in the normal range for each transfer. The same was true with the web site transfer. The first download batch took well over 25 seconds repeatedly. This accounts for the large discrepancy in overall averages between the scanned and not scanned tests. Overall, the scanners and/or firewall (I couldn't tell which because the reproduction of the anomalies was inconsistent) performance seemed a bit unpolished and, despite the power of the firewall and the general usability of the package, it would be hard to recommend the package as a high performer. The CyberScrub AntiVirus Lifetime Edition runtimes took up about 30Mb of system memory.

I also found a bug with the Kerio interface. I disabled the firewall through the administration tool which, I expected, would turn the firewall off. However, when I attempted to run my tool, I noticed traffic was still being blocked. It turns out that the firewall was still operating in the background and only after I explicitly shut it down from the taskbar icon, could I then connect to the internet through my tool.