Is AVG better than Norton?

I'm writing this thread because I've come to a point where I can't understand why people consistently recommend AVG and trash Norton as if it's some rogue, derelict AV that isn't worth spit. Aside of all the obvious reasons (costs money, system resource hog, slower scans), I feel that Norton is the better product of the two. Now, let me set something straight right off the bat. If being free, using less system resources and quicker scans are the reasons you feel AVG is better, so be it. Those are all valid, legit reasons you may prefer AVG over Norton. Myself? I don't mind making some sacrafices for a better product which I think Norton is. No worries, I plan on backing up my claims unlike some people who just sit there and say "AVG is better than Norton" and provide nothing in the way of actual test results that back up their claims. I plan on using a range of test results to gauge an overall idea of how these products have faired in the last 2-3 years. So don't get your panties in a bunch if some of these links have test results from a couple years ago (mainly av-test.org).

So let's start with what I consider one of the better independent AV testing sites: Virus Bulletin.
Let's compare the overall performance graphs of Norton vs. AVG. These consist of various tests, various OS's, and various versions of each AV over a extended amount of time. Look just under the "Overview" section of the links I'm providing, you'll see a green/red meter bar and test results for each. (Feel free to delve further into the details of all the tests).
AVG's overall performance
Norton's overall performance

Ok, I thought. so what. It's just one site. So I searched some more. Off I went to PC World where I found a June 2004 issue that did an AV comparison which included AVG (It's not always easy to find AV test results that have both AVG and Norton). Take a look Here

I then checked out some of the tests on www.av-test.org where once again, Norton consistently faired better than AVG. Unfortunately, these tests are not very recent but relevent if we're going to gauge the overall track record of both Norton and AVG. Check these 3 seperate test results out which span over a 4 month period. If you want to view them without having to click on all my links, then go to av-test's website, click "Tests" on the left hand side and you'll see that I selected the 3 most recent tests on Windows platforms that included both AVG and Norton.
2002-01 Test
2001-11
2001-10
I tested these links after I posted and for some reason I got re-directed to a different section on the site. If you do too, then just go to the main page, click "Tests" and select a test: 2002-01, or 2001-11 or 2001-10. Click "Online Version" and then select "Next" on the next screen. I found it easier to sort the results in descending order.

Don't get me wrong either. For being free, I think AVG does an excellent job. I'm sure the Pro edition works just as well. This isn't an anti-AVG thread believe it or not. Problem being is that I'm sick and tired of people bashing Norton and making claims that AVG detects more viruses and it an overall better product without any actual test result data to prove it. I myself have tested AVG 6.0 vs Norton and have ran into a situation (more than once) where AVG has missed viruses that Norton has found (This still doesn't make AVG a bad product in my eyes). I'm not using this as relevent data to prove my point because I simply can't prove it happened. However, these testing sights do provide observable results.

Now, feel free to go searching around the internet, books, newspapers etc and find me something, anything that flat out says - AVG is an overall better product when compared to Norton (in regard to test results). I'll glady welcome the results because if it is indeed true...that AVG is better than Norton, I'll gladly switch over to AVG and save myself some money.

*note - I warm up nicely to constructive criticism and I believe this post begs for it. So feel free to tell me why I'm incorrect in my thinking, if you should feel I am in error.

Hey Hey,

I don't trust any of those sites... I've very seldom see a major AV company get something other than 100%.... I think money buys publicity in most of these cases... and it can buy your score.

Have you checked out my AV Research thread? I think the excel sheet speaks volumes for the AV companies... now that I'm on holidays again, I plan to wrap things up with the rest of the AV Vendors..

Anyways.... Norton may be adding Spyware and Adware to their defs... but they're falling behind on Virus definitions... I move 5-10 people a week from Norton to AVG... they all still have valid subscriptions, but their computer, even with norton, is riddled with worms... I had that on two computers tonight.. AVG doesn't always have the ability to clean them (+s flag is an example.... but it at least tells you the file location so you can manually delete it)... Norton isn't even detecting them..

I'd be more than happy to keep a log of viruses detected on machines and work and the AV they are running if you are interested and periodically post the results.... but I could tell you many horror stories.... Computers w/ 3000+ viruses... running Norton and nothing being detected..

On top of the two machines that I removed Norton from tonight, I had another with Norton... I had to use Trend Micro's System Cleaner to remove the remaining viruses... While you'll find viruses that AVG doesn't detect... it seems to be fewer than the number that Norton detects....

AVG's minor downfall (I believe) is in their update system... It used to be that a system would update every 14 days (depending on settings) @ 8am... They've now (in the latest update) changed that time to 6:30.... the problem with this is that most users don't have their PCs on at this time.. The Manual Update option isn't overly visible (as it is in Norton)..... AVG pushes out new defs quite frequently.... sometimes daily, othertimes every few days.. depending on activity.... The 14 day default update period is too long... I think that changing these settings would make it more beneficial to the end user.

I trash Norton because I've seen it fail miserably.... every IT person I know has removed Norton from their system because it hasn't held it's own against other companies.... When I was working with the last set of co-ops (8 months ago or so)... I'd recieve 2 or 3... sometimes 4 updates to every 1 update that the Norton users would recieve... They all ended up changing...Most people I know that are paying for AV these days are going to Trend Micro (Which is by far the most efficient with worms and trojans)... A buddy of mine working for the RCMP (The Mounties).... said they recieve updates 2 or 3 times a day from Trend Micro...

Anyways.... That's my two cents... Let me know if you're interested in a log... I'll be more than happy to keep one for ya.

Peace,
HT

I have cleaned up a lot of boxes...

I usually see the box after it is mauled by malware. Norton is a very, very popular AV, and it's on 80% of the boxes I get called to. The problem is, 99% of the time, the def's are outdated. Now, performance aside, what good is an AV if you can't get sigs? Money is the factor...

AVG provides you with a solution that lets you auto update sigs and give you realtime protection. Whether it is better or not, it is better that nothing. Unfortunately, user ignorance prevents the purchase of subscriptions. I get called to a box (I actually don't get called, I work for free for friends, just because I have a productive nature) and I see that the subscription is expired. So, I can install AVG, set it on auto update, auto scan once a week, I'm happy, the user is happy, and nobody lost any dollars.

ClamWin is my favorite for the computer literate. The defs come out quick, are accurate, and you can make your own. There is no realtime protection, so it saves greatly on resources. I can't wait for a group to make adware sigs for it (hint hint someone). Two birds with one stone would be great.

My experience with realtime AV overall, is that they all suck. If you get infected, AV's have a hard time ending processes. It's because most new malware doesn't get stopped by a single end process method. That's why I like ClamWin. It's perfect for safe mode (where the actual removal process works)

Its hard to tell which is better, comparing the "top winners". A big (american) tire company just moved (18 months ago i think) from McAfee to Norton just because they think that Norton Is better. I use to see replacements between those 3 or 4 a/v all the time. For example, I m working as a consultant for a big bank here and they simply "love"
Norton. However, they use trend micro products on server for e-mail scanning e anti-spam features. Their analisys showed that Norton Products arent good enough to protect servers...Go figure...

I am an avid AVG pusher to people whose computers I have had to fix, but they don't want to spend any money. I agree totally about the updates, it often seems combersome for your average computer illiterate person to run the updates because it requires like 3 or 4 actions. And for a majority of people that donthave broadband, automatic updates are pretty much out of the question. Updating in itself is a little flakey but has vastly improved over the last year.

To my knowledge, and I could be wrong about this, Grisoft doesn't produce virus removal tools like Symantec does, so in my mind, a mixture of the two isnt too bad, especially if you are on a shoestring budget.

As long as you have updated defs they seem pretty equal.

I have use both AVG and Norton...(not on the same machine)

Each one has their merits ...depending on the enviroment. Mostly recommend AVG for the home user (they like it cause its FREE) and mostly norton\symantec for the network enviroment. Yes there are some bugs...but the newer versions are much better the the 7.x CE editions IMHO and symantec has fairly good self help on their site to over come these

One thing I have noticed lately though...is I have worked on a lot of under-powered XP machines ..128MB ram etc.

And yes if you remove norton...your system will perform better.

Mostly..I recommend more RAM as the systems are running firewalls\anti-spyware and AV...all this would bog down any computer with minimum RAM

One thing I almost switched to PANDA as I have read and heard good things about it....maybe next year as the offer competitive upgrade paths.

MLF

I've tried AVG but not as the sole AV on my machine.I've used Norton at home for about 6 years and have never been infected (I've double checked periodically with other AVs). I found the Automatic Live Updates work well for the user who will forget everything you told them once you walk out the door. That keeps the reasonably safe for the first year until they start to ignore the Renewal reminders.

i can't imagine anything better than norton for a corporate network. i got hit once with an 0day. no system is immune to 0days. i reported it to symantec and in less than 8 hours had a fix and an emergency definition update. other than that i havent been hit with anything. norton corp caught it all, now THAT is amazing.

Hello all. I have to do a quick response here. bah. Have to leave for work in 10 minutes but, I appreciate all the responses.
HTRegz,

Quote:

---

I'd be more than happy to keep a log of viruses detected on machines and work and the AV they are running if you are interested and periodically post the results

---

I think that would be great idea. You're cutting out all the middle men and getting right to the source by testing AV's yourself. I'd bevery interested in your test results and besides, I think it would make for a great way for everyone at AO to finally see some down and dirty results from one of it's own members (which means no "doctored" results :D ). Like you implied, it is possible that the sites I listed may have corrupted results because of outside influences. There is always that possibility.
At this point, I want some hard test results. I want to skip past the bullsh*t and find out, which really is the better AV. As much as I scoured the internet, I couldn't find nearly as much on AV comparisons as I wanted, nor enough test results of independent studies that were worth their weight in gold. IF there is enough evidence mounted, I will gladly switch products. Again, I'm an open minded individual when it comes to practicality and feasability.
In any event, I gotta bolt.

*note - HTRegz, I recently reformatted this computer and haven't had a chance to re-install MS Office. I have no Excel to view your spreadsheets :eek: otherwise I would have checked it out. I believe I'm picking up the Office CD tonight and installing it later tonight. I'll check out your results as soon as possible.

Quote:

---

i can't imagine anything better than norton for a corporate network. i got hit once with an 0day. no system is immune to 0days. i reported it to symantec and in less than 8 hours had a fix and an emergency definition update. other than that i havent been hit with anything. norton corp caught it all, now THAT is amazing.

---

I use Norton Enterprise on my system as my 3rd line of defense for incoming email. As a first line I no longer trust it. I have to admit that recently the ability to pick up some bugs that are being shown in iframes etc. is good and has fired a few times in the last couple of weeks where it never ever fired before.

Caveat: I'm talking about inbound email protection, (the most common vector).

My current system for inbound email is as follows:-

1. All my hosted domains have a single MX record pointing to my "Mail Sentry".
2. The "Mail Sentry" is located in the DMZ of my firewall.
3. My firewall strips all files with an executable extension from inbound SMTP transfers, (that kills most crap right there).
4. The "Mail Sentry" uses GFI's Mail Essentials for anti spam, (cost item but small).
5. The Mail Essentials cuts each email to disk to look at it in a temp file.
6. BitDefender Pro, (another small cost), that updates hourly scans the .tmp file.
7. If Bitdefender Pro kills the .tmp file for "badness" Mail Essentials gives up on it, (good thing).
8. Mail Essentials does it's spam filtering.
9. If it passes Mail Essentials it is forwarded to the appropriate internal mail server.
10. Norton Enterprise for Exchange receives the incoming emails and scans them
11. The user gets their email with no AV on their box.... :eek:
12....... It works.....

I used to use Norton as the only gateway. But like all AV's they are reactive. They require the virus to be known by _anyone_, then by your AV vendor, then the AV vendor needs to have produced a viable sig, then you have to have downloaded the sig before the virus gets there. The fiasco with MyDoom, Netsky and Bagle proved that this is a flawed model that will always fail as the virus authors improve their "tactics". Thus I determined, in a corporate environment, the requirement is a proactive approach.

Passing executable files by email is totally uneccesary for the _normal_ user. There is no reason for anyone who doesn't understand what "executable" means in computer terms to be receiving them. For those that may need to pass executables they are quite able to grasp the "complexities" of retrieving a file from an FTP server in the DMZ, (a significantly lesser medium of virus transfer that requires the sender to authenticate to the server before upload is allowed). This also allows the "slowing" of the process so that virus defs may be updated or the file could be held during a "storm" until it is deemed safe.

[Back to the topic at hand]

Norton used to be a fine product but it has become invasive and bloated. I am also peeved by three things:-

1. It comes on every new computer, (ok, that and McAfee), so people _think_ they are protected even though the PC they just bought has been sat on the shelf for 3 months and the defs don't auto-update by default and without "effort" by the purchaser.
2. After 3 months it nags the crap out of the user to _buy_ the product, (which the kids click past every time because they don't have any cash leaving the parents box utterly unprotected.
3. Uninstalling Norton from a brand new XP box leaves some DLL's. In some circumstances, (twice IME), these .dlls get called by something and due to the lack of the rest of the "bloat" the XP box blue screens..... I have yet to see an XP box blue screen for anything other than these damned norton dlls that are left in place with their system calls by something as yet unknown!!!!

As a side note I have never trusted McAfee.... Many years ago, (and I have no proof like no-one else did), I used to talk in the evolving AV world over the BBS's and 1200 baud modems :eek:. I talked with Frisk of F-Secure and others. The general consensus was that McAfee was either a) Dark Avenger or b) his best buddy..... 'nuff said?

Some of the "new" AV companies are doing a good job.... I haven't settled on one yet to be honest but I'm still trying to find either a free/effective solution or a low cost for larger _cash poor_ companies that is either effective or able to be used in a multi-layered approach as a final layer, (the desktop).

That's my $2.5 on the issue.....

Well, I had a chance to browse over that Excel sheet and check out some test results. I'm assuming for Norton, if you didn't specifically mention it didn't clean it, I'm assuming Norton cleaned it? Another thing I wasn't so sure about was the "Type" heading. Anyways, here is what I found: The numbers in (#) are the numbers of occurences/copies found.

AVG (These are infected files ONLY AVG found)
----------------------------------------------------------
browserhelper2.dll


BOTH (Both AV's found these files)
-------------------------------------------
actalert.exe (2)
actalert[1].exe (1)
Installer2.exe (1)
optimize.exe (2)
polall1l.exe (2) (Norton found 4 occurences/copies)
TT.exe (1)
T[1].exe (2)
UnstSA2.exe (1)
winmplayer.exe (1)



Norton (These are infected files ONLY Norton found)
-----------------------------------------------------------------
bling.exe (1)
system.exe (1)
bargains.exe (1)
conscorr.exe (3)
exdl.exe (1)
exul.exe (1)
Key2.txt (1)
lc.exe (2)
ln_reco.exe (2)
msbb.exe (1)
msbbhook.dll (1)
msbe.dll (1)
nem220[1].dll (1)
preInsln.exe (3)
SyncroAdX.dll (1)
tmb.exe (1)
WebRebates0.exe (1)
WebRebates1.exe (1)
Wincomm.exe (2)
WinComm[1].exe (2)

Did I read the spreadsheet correctly? I'm hoping for AVG's sake, I didn't. Feel free to correct me if I'm wrong. Anyways, I wanted to mention that this is some great stuff you're doing HTRegz. I haven't had that kind of amibition since I was in my 20's. I'm getting older, lazier, and I'm convinced my brain is decaying at an extremely rapid rate :D

Hey Hey,

You read them correctly, but look at how many Norton incorrectly identified as malware... instead of as Viruses...

As far as the problem viruses for us go.. you only have two...
winmplayer.exe
system.exe

While Norton detected both.... it incorrectly identified system.exe as beign Adware instead of being a virus... If you are looking for a combined AV/Malware scanner... then Norton seems to do a pretty decent job... However, a lot of people would see the list and only clean the viruses.... Thus they are getting a false sense of security...

Since September, I've cleaned... I dunno conservatively... 100+ machines... possibly quite a few more... 40-45 working days... up to 6 computers/shift (it's only part of what I do)... occasionally more.. somtimes only 1 or 2.. I've seen computers with Norton, AVG, eTrust, Panda, Trend Micros PC-Cillin, McAfee, StopSign, Fprot, Sophos and a few others.... none of them have every been 100% effective as AV software... As Tiger Shark said... AV is reactive.. We've ended up relying heavily on Trend Micros System Cleaner... almost like a downloadable house call (however it scans for a rather narrow list of viruses... (maybe I'll include it in my next round of tests... depends on how much drinking I do for Halloween)).

We've also relied on a simply batch file, pskill and reg.exe... As Soda said... AVs suck at killing active processes... I have a batch file that's sitting at 55kb (I've got about 10kb of information to add to it this weekend)... I've posted it on here before and it's process is rather simple.. It kills the process, removes Read Only, Hidden and System flags and then deletes it... It also deletes Reg Keys related to the various viruses we've found... It's the closest we've found to a decent solution... so much so that there's been talk of adding it to the Startup and Shutdown scripts on the domain..

We have a rather complete CD that we use for cleaning... I'm going to be modifying it this weekend and setting it up slightly differently.. It's size is around 500MB... so I'll try and find a way to make it available, however my webspace only has 5GB/month and my DSL won't stay up to long with a lot of leeching.... Perhaps I'll make a torrent and post it on here (don't worry.. the CD is completely legal... no pirated software or anything.. hell we use it in a corporate environment).. Anyways... that's my task for tomorrow during the day, so I'll make it available for the weekend somehow... Even if you have to PM me for the details.... I'll also try to post the next section of the excel sheet (in the AV research thread.. with a link here if warranted) sometime early Monday morning.

Peace
HT

FYI HTregs...

StopSign is bogus. If you come across it, remove it. It is agressive, removing competition like adaware and spybot. At least it was a few months ago... eacceleration products are bogus.

Have you ever ran into wintools? It's like 4 processes, wintools, wintoolss, wintoolsa and something else. I wrote a C# prog to kill the processes at once, and didn't work.

http://www.giantcompany.com/antispyw...-WinTools.aspx

Quote:

---

Files called wtoolsa.exe, wtoolsb.exe, wtoolss.exe, wsup.exe, and wtoolsb.dll install with an adware program called "WinTools". Wintools installs itself as a service or "legacy service" that runs on system startup. It acts as a search page and home page hijacker. This program may have been intentionally downloaded or it could have stealth installed along with Gain, Gator, or Claria.

WinTools uses driver level methods to create it process making removal quite difficult. Simply terminating the WinTools processes will in no manner kill the process. Even terminating the entire WinTools processes tree will not allow this making manual removal quite difficult. Once the WinTools process tree is terminated it recreates itself by attaching to any running Windows process. Since it is a low level process the execution of WinTools in most cases bypasses the Windows Shell.

In addition to the driver level processes WinTools installs a Windows service. However the reason for this service has yet to be identified, as it does not make a connection to the Internet to send data.

---

How the hell do you clean this type of malware? Only possible way I've succeeded is safe mode. I don't use AV in normal mode anymore, it's worthless.

Quote:

---

Originally posted here by Soda_Popinsky
FYI HTregs...

StopSign is bogus. If you come across it, remove it. It is agressive, removing competition like adaware and spybot. At least it was a few months ago... eacceleration products are bogus.

Have you ever ran into wintools? It's like 4 processes, wintools, wintoolss, wintoolsa and something else. I wrote a C# prog to kill the processes at once, and didn't work.

http://www.giantcompany.com/antispyw...-WinTools.aspx


How the hell do you clean this type of malware? Only possible way I've succeeded is safe mode. I don't use AV in normal mode anymore, it's worthless.

---

Hey Hey

HTRegz <-- Note the z :) hah.. anyways...

StopSign is bogus eh??? That's humerous... I constantly see ads for it.. and know a lot of people that have ordered it... Never really looked into it myself.. I usually remove it, solely because I like to push my preferences on the users :D... Can't say that I've seen WinTools yet... However that setup is similar to some software I saw the other day.. I ended up using safe mode.. First time I've booted a computer into safe mode since I started this job... I'd rather clean it by hand than boot safe mode to run a virus scan. I'm very anti safe-mode... I figure it it can't clean it... It'll reboot and clean it.... This may seem like a lot of work, but when your working on multiple machines it's faster to do it this way (it's unattended) then it is to take the 20 second to boot safe mode.. especially when you're running to answer phones in between.. To clean that one machine, I had to boot 15 times before I was actually @ it long enough to get into safe mode...

The main problem we're running into is that we've got all the Network Aware Adware... that scares me... plugging a machine into the network without ever having browsed anywhere and boom... Popups..

Anyways,

Peace
HT

Quote:

---

I myself have tested AVG 6.0 vs Norton and have ran into a situation (more than once) where AVG has missed viruses that Norton has found

---

I dont know whether u r wrong or not and i also saw the links u provided but i myself used Norton Antivirus 2004 and also AVG 6.0 but what i found was that both of them(one at time) were not able to make my box virus-free although my virus definitions were up-to-date so no chance of obselete data. than i went on searching on google.com and i found PANDA ANTIVIRUS PLATINUM SECURITY 8.00( i m sorry i dont remember the link as it was sometime back) and wow, it proved to be a boom to me, it not only removed all the viruses from my PC but also made it faster! and now i can browse any part of the internet without worrying for the viruses!!! it also provides a firewall which is compatible to the Windows XP Service Pack 2 firewall and together they make a fabulous combo!! thats my piece of experience and if u ask me i'll seriously recommend Panda AV!!! dont take me wrong but do tell me if something opposite happened or Norton AV 2004 have now became more efficient and is now able to perform better than others as i'll then get that thing into action.... u dont want to keep a expensive thing u bought just like a piece of junk! do u?

In my highly personal view, all AV are basically the same for home users. All of them are not accurate at 100% anyway.

Ok, I checked over some more stuff and I hate to be anal retentive but, it's about the only thing I'm good at anymore(well, that and drinking) :eek:

Quote:

---

While Norton detected both.... it incorrectly identified system.exe as beign Adware instead of being a virus

---

Looking again at the Excel spreadsheet (for Norton AV 2004), I noticed this:

Quote:

---

Virus--Bloodhound.W32.EP--C:\Windows\System32\system.exe

---

Didn't it correctly identify Bloodhound.W32.EP as being a virus? One thing I did notice however, is that it had a difficult time when it came to cleaning the virus. I couldn't really determine which other AV products were able to clean it besides Trend Micro. I then putzed about to see what the other AV's called system.exe and I wound up realizing just how ridiculously complicated this mess has become. Take a look at this list of System.exe descriptions:

Sophos -- Virus--(W32/Rbot-Fam)
eTrust -- Trojan--(MS03-026.Exploit.Trojan)
ClamWin -- Exploit--(DCOM.Gen)
AVG -- N/A
Norton -- Virus--(Bloodhound.W32.EP)
Trend Micro -- Worm--(WORM_RBOT.ZO)
Pest Patrol -- Trojan--(TrojanProxy.Win32.Mitglieder.x)

After this, I went around trying to find definitions of what exactly the difference is between worms, viruses, trojans, adware, spyware, dialers etc etc. I'll tell you honestly, it was nothing short of total frustration. There was some mutual agreement on various websites between the differences of all these terms and characteristics but, at one point or another, they did indeed differ. I mean, just take a look at the names of this virus/trojan/whatever the hell it is. Out of 6 AV's that found it, there's 6 different names to accompany each one. Does anyone else find this utterly ridiculous?

Anyways, it's Friday. I'm getting the hell out of my house and go kill off some of the weaker brain cells with beer :D

Hey Hey,

Killing the weaker brain cells :)... The Cheers theory eh..

Anyways...my bad.. it was late and I misread.. .... however I have issues with the way norton labels things bloodhound... It gives that name to hundreds of objects...

I'll hopefully continue my tests at some point this weekend.. and we'll see what kind of results we get..

I agree about the naming conventions... a standardized virus naming would be very convenient..

Peace,
HT

HT- Bloodhound is the heuristic engine that NAV uses. If it has the Bloodhound prefix, it got picked up through it's heuristic signature. IIRC, Norton's bloodhound sigs were successful in detecting netsky or bagle variants... Although I may be thinking of another AV.

I haved used norton internetsecurty all my live adn have never got an infection. Sow i would recumend it to eney one who would want a AV program.

Soda:

Heuristics scans without signatures. It looks for certain patterns in code. Email-borne viruses are a good example. In order for the virus to work it will have to insinuate itself into startup somehow so it will contain code to alter the registry, the startup folder or some other vector. Then it is going to have to spread itself so it will have code for it's SMTP engine. So upon seeing this file a heuristic engine would say:-

1. File changes the registry
2. File uses code to transmit email
3. File is smaller than xKb so it isn't a mailserver installer

:eek: this could be a virus......

I can’t speak for others, but past experience is what dictates what I use. Although I don't remember trying AVG, perhaps others who do feel as strongly and have had similar experiences with it as I have with Trend Micro products.

Years ago when I first got hit with a virus and it hosed my home machine ( I think I was running MS anti-virus at the time, but the updates were almost non-existent, and luckily I had backups ) I started “borrowing” AV programs for testing purposes. There were only a few back then, but Norton and McAfee both seemed to slow the machine down considerably ( it was running Win 3.1 as I recall ) and kept conflicting with running apps. I found PC-Cillin ( then distributed by TouchStone software ) to be the most stable and reliable, did not impact on performance and came with “ 100% Virus Protection Guaranteed” and “ FREE Lifetime Updates”.

Although they no longer offer the “FREE” updates for that program as of a month or two ago ( I believe it started with version 3, which they upgraded free to version 6, and went through an OS upgrade to win 95, then win 98 and several motherboards ) I never again lost any data on that machine due to a virus. ( you think I can sue 'cause they failed to fulfill as advertised? )

Though they don’t make those claims anymore ( now yearly subscriptions, disclaimers, etc. ), when I had a problem on another machine with conflicts ( running XP, Netscape and PC-Cillin 2002 ) they responded with a fix ( e-mail attachment ) within half a day!

From what I have seen Norton over the years has become more stable and less prone to conflicts then in the early years, but I have cleaned many a machine even recently running Norton AV using Trend’s “HouseCall" . And have not as of yet ( hope I didn’t jinx myself ) had any infections on any machines running PC-cillin.

And for McAfee , where I work they use it on the network. When I received an e-mail from one of the top administrators which contained a virus ( routed through a web site I manage ) and I informed him of it, the replay I got a month later was they had a virus on the network and had been trying to clean it for a month and a half! ‘Nuf said! ( Yes, that’s true, yes I know what you’re thinking, don’t go there. My head has already bled from hitting it against the wall on numerous occasions! )

As for others, I have installed many to test over the years ( currently have the October Sophos disk and plan to try it on Linux now that construction is done, the granddaughter has her own room and I am getting my computer room back ... she’s a year old already! ) but I have found none that has proven better then PC-cillin .
So until it lets me down I will continue using it, at least on my main machines. And the 2005 version ( in response to another thread ) now scans for Spyware and includes the ability to " configure, update, and control PC-cillin Internet Security running on any PC on your home network—managing all functionality through a single interface", ( though I haven't tested those features yet ).

Quote:

---

Bloodhound is a complete departure from traditional virus scanning technology, which typically relies upon virus “signatures” or fingerprints to detect virus infections. When an anti-virus company receives a new virus, it analyzes it and extracts a virus fingerprint. The virus is then considered “known” and can be identified by subsequent updates of the anti-virus product; viruses that have not yet been analyzed are invisible to such anti-virus software.

Rather than using signatures, Bloodhound detects viruses by inspecting executable files for virus-like behavior. Since many viruses are finicky and only spread under ideal circumstances, the SARC heuristic system actually “coaxes” viruses into exhibiting their malicious behavior. If a program exhibits such virus-like behavior, it is passed on for further analysis by the Symantec AntiVirus Research Automation (SARA) system or a SARC virus researcher. This heuristic technology has been shown to detect up to 80% of new, unknown viruses.

---

I think Bloodhound detects viruses, (Does it send mail, does it have trojan behavior, yadda yadda), and reports home to have the file tested if it is not recognized as a virus. From there, non-heuristic signatures (old school) are made to deal with the virus. First heuristic detection, and then signature based removal. The signature that is developed from a Bloodhound detection is given the Bloodhound prefix. At least that's what it sounds like to me. Because otherwise, every program that connects to a mailserver, even if it is small, will be a false positive. I don't think heuristics is trusted enough to act as a removal engine, but I think it is being used to speed up Symantec's sig releases.

edit:
Back when I used Norton, I remember Bloodhound asking me if I wanted to send in a specimen to Symantec, but I can't recall if it actually did anything with the file in question.

edit 2:

http://securityresponse.symantec.com...xploit.13.html

Bloodhound.Exploit.13 is not called a "signature", but it pretty much is a signature, just of a different breed. Bloodhound would not have been able to detect the jpeg exploit unless it was told to look for it. My point is that heuristic engines still need to be told what to look for, such as mail daemons, jpeg exploits, or whatever. That sounds to me like a "heuristic signature". A "heuristic signature" is more like a set of directions to find, than a fingerprint. Of course a heuristic signature now sounds like an oxymoron... although I will still call it that for lack of a better name.