Battle of the Security Superpowers

It’s no longer enough for antivirus software to scan files on your PC. You need someone looking over your shoulder and telling you whether it’s safe to click that link; whether the popup for that software update is legitimate; and whether that download from your favorite social network is actually a tool created by organized criminals for stealing your personal information. You need an all-in-one Internet security suite capable of identifying, blocking, and cleaning up after a wide array of malware.

We examined 13 security suites for this story. To handle our ex­­panded Internet security testing, PCWorld contracted for the services of AV-Test.org, a respected security testing company. We looked at traditional signature-based de­­tection (which indicates how well products can block known malware) and at how well the suites cleaned infections and blocked brand-new, live malware attacks.

In many respects, the suites we looked at produced closely bunched results, but they did vary in the efficacy of their protection and in the extra features they offered. Ultimately, we picked Symantec’s Norton Internet Security 2011–the most balanced of the suites–as our overall winner.

New Threats for a New Year

Malware has migrated to social networks, so this year’s Internet security suites put more emphasis on stopping Web-based attacks. Norton Internet Security 2011, for example, has Norton Safe Web, a feature that hooks into your Facebook stream (with your permission) to scan your Facebook links and proactively block malicious ones. Other suites this year look for techniques that cyber-criminals use in attempts to poison SEO (search en­­gine optimization), loading up on popular search keywords to make malware-compromised sites appear higher in search results. A suite may flag any such sites in search results as unsafe or questionable.

Another threat is the resurgence of banking-related malware. Though some suites protect against certain types of banking-specific malware–Kaspersky Internet Security 2011 offers a virtual, on-screen keyboard that lets you bypass traditional keyloggers, and in our tests, Panda, followed by G-Data, offered the best detection rates for known banking-specific malware– no suite targets the relatively new “man-in-the-browser” attacks, in which the malware doesn’t activate until you have successfully logged into your bank account.

Practically all suites offer some method to prevent malware from downloading through your browser without your consent. For example, a Website might pop up a fraudulent warning that your PC is infected and that you must buy a particular (but fake) antivirus program to remove it. Or it might trick you into downloading Trojan horses disguised as the latest version of Adobe Reader or Flash. Most security suites now monitor browser downloads and filter out this bogus software.

Comodo Internet Security 2011 Complete (which did not capture a spot in our Top 10 chart–click on the thumbnail at left) and the Kaspersky and Norton suites offered the best detection in our “real world” malicious downloads tests, which gauge how well the various suites block brand-new, as-yet unknown malware. And Norton Download Insight, which filters bad apps, now supports the Chrome, Opera, and Safari browsers (and AOL) as well as Internet Explorer and Firefox. Download managers from other companies typically work only with IE and Firefox.

Improved from last year is Norton Insight, which measures the relative trustworthiness of the files loaded on your desktop. The idea is that crowd-sourcing safe files (letting consumers around the world rate a file’s safety) is better than white-listing them (depending on a static list of acceptable files).

Crowd-sourcing is also behind so-called cloud-based detection of new malware. Security software reports suspect new files from a PC to the cloud and creates antimalware signatures as needed. In 2011, BitDefender, Comodo, and others join cloud pioneers McAfee, Norton, Panda, and Trend Micro.

For detection and removal of “zoo malware” (a collection of known worms, bots, backdoors, and downloaders) using traditional methods built into the program, Panda had near-perfect scores in our tests, followed by Avira and G-Data.

All 13 of the security suites we reviewed offer at least antivirus, antispyware, and anti­spam components, plus a firewall. Some, such as Eset Smart Security 4 and PC Tools Internet Security 2011, had little more. The others provide additional capabilities–parental controls, gaming features (such as a “silent mode” that won’t interrupt a game with alerts), and online backup (useful if malware ever nukes your PC).

A few products also boasted “sandbox” features that run a new app within a protected environment so that if it turns out to be malicious, it can’t infect your operating system. In 2011, Avast, Comodo, and Kaspersky all offer this feature.

Performance Issues

Many users worry that a security suite will slow their PC. This year, AV-Test ran a battery of tests to address that concern, looking at a number of key aspects of a suite’s impact on PC performance–including boot time, application launch time, file copy operations, application installation time, and file compression, among others. AV-Test also looked at how quickly each suite scanned a PC for viruses and other malware.

(For the three suites that had the most and the least impact on system performance, as measured by memory usage, see the “RAM Hogs” chart at the end of this article.)

Overall McAfee Internet Security 2011 had the least impact on system performance, with faster-than-average scores in all 13 tests, and very good scan speeds. On the opposite end, PCTools added the most latency in nearly all the tests despite having the fastest on-access scanning speeds. While top-ranking Norton Internet Security wasn’t as light in impact on system performance as McAfee, it had better than average scores overall, though performance dragged a little more than average in a couple of tests. For on-demand scanning speed, Eset had the fastest score.

The overall score for each suite takes into account various aspects of malware detection, blocking, and cleanup; the feature set; and ease of use. However, malware detection, blocking, and cleanup account for the lion’s share of the scoring.

For more on our testing, see “Security Software: Testing in the Real Wild World.”

Here’s a summary of our findings on each suite, with links to the full reviews. Click on each thumbnail image for a full view of the screenshots.

Symantec Norton Internet Security 2011

Pros: Streamlined, extremely efficient; combined rating for security and performance put it in first place.

Cons: Interface initially looks overwhelming; fortunately, you can ignore much of it.

Bottom line: Norton’s nicely designed suite does an ex­­­cellent job of fully blocking and cleaning up active malware.

Symantec Norton Internet Security 2011 review

Kaspersky Internet Security 2011

Pros: It earned second place overall in our tests; has a couple of uncommon, useful extras.

Cons: Installation is a headache.

Bottom line: Kaspersky Internet Security 2011 provides solid defense against malware and has a friendly interface.

Kaspersky Internet Security 2011 review

BitDefender Internet Security 2011

Pros: Offers a good level of protection and avoids false positives; one of the best products at fixing infected systems.

Cons: Having BitDefender installed slows a PC significantly; scanning can be sluggish, and installation tedious.

Bottom line: BitDefender’s multiple-mode interface is overcomplicated, but this full-featured suite blocks malware effectively.

BitDefender Internet Security 2011 review

PC Tools Internet Security 2011

Pros: Very good at blocking malware and cleaning up infections

Cons: One of the slowest at on-demand scans; slows PCs the most.

Bottom line: While PCTools Internet Security performs superbly at blocking malware, it is hobbled by slow scan speeds.

PC Tools Internet Security 2011 review

G-Data Internet Security 2011

Pros: Offers a superior level of security and performance in cleaning up infections.

Cons: It’s hard to use, processor use is significant, and it has some design quirks.

Bottom line: G-Data posted high marks for its ability to detect known malware; however, it didn’t catch some new threats.

G-Data Internet Security 2011 review

F-Secure Internet Security 2011

Pros: Keeps everything simple for novices and families.

Cons: Terribly slow at on-access scans.

Bottom line: F-Secure Internet Security was reasonably successful at blocking threats and is easy to use, but it scans slowly.

F-Secure Internet Security 2011 review

Trend Micro Titanium Internet Security 2011

Pros: Good results at blocking malware and fixing infections, with few false positives; some will like the minimalist interface.

Cons: Very slow on-demand scans; its default Quick Scans may give some users a false sense of security.

Bottom line: Trend Micro Titanium Internet Security is a good defender, but this package is light on extra features.

Trend Micro Titanium Internet Security 2011 review

Panda Internet Security 2011

Pros: Very good protection.

Cons: Rife with false positives; scans slowly; has poorly designed interface.

Bottom line: Panda’s 2011 security suite is generally effective, though its blocking of new malware wasn’t top-notch.

Panda Internet Security 2011 review

Eset Smart Security 4.2

Pros: Fast scans; little effect on system performance; few false positives.

Cons: Finished at or near the back of the pack in most of our malware detection, blocking, and disinfection tests.

Bottom line: Eset Smart Security 4.2 is speedy; unfortunately, it struggled at detecting and removing malware.

Eset Smart Security 4.2 review

Avira AntiVir Premium Security Suite

Pros: Turned in good protection numbers and is one of the faster scanners.

Cons: Left lots of remnants of malware behind; had too many false positives.

Bottom line: Avira AntiVir is very good at blocking known malware, but it left behind more malware remnants than most suites.

Avira AntiVir Premium Security Suite review

Comodo Internet Security 2011 Complete

Pros: Blocked all 25 real-world malware attacks in our testing; has a sandbox system for running potentially unsafe applications.

Cons: Poor detection rate with known malware samples; chaotic interface; installation is a pain.

Bottom line: Absent a solid level of core security, it’s hard to recommend Comodo.

Comodo Internet Security 2011 Complete review

McAfee Internet Security 2011

Pros: Put up solid numbers in detecting known malware; has extras such as parental controls; often available at a discount price.

Cons: Very poor numbers in real-world malware blocking and with false positives.

Bottom line: McAfee’s solid performance at detecting known malware earns it some consideration, but its dismal real-world malware blocking and over-the-top problem with false positives give us serious pause.

McAfee Internet Security 2011 review

Webroot Internet Security Essentials 2011

Pros: Did well at blocking real-world malware attacks in our tests; simple to navigate.

Cons: Did poorly in most other tests; high rate of false positives; slow scan speeds and a drag on system performance.

Bottom line: The application’s extras don’t really matter if it isn’t keeping you safe.

Webroot Internet Security Essentials 2011 review