Webroot Internet Security Essentials: Short on New-Threat Detection

Webroot Internet Security Essentials ($60 for three users as of 3/16/2010 ) placed ninth in our 2010 roundup of security suites. The suite is essentially Webroot’s SpySweeper antivirus/antispyware application packaged with a firewall, an antispam utility, backup software, and Internet browsing protection thrown in. While that may satisfy fans of SpySweeper, it may not be enough for everyone else: It lacks the parental control features that are common in other Internet suites, and it falls well short when detecting and disinfecting brand-new malware threats.

Though the Webroot interface is serviceable, it needs some improvement. Webroot uses a three-column layout, with navigation on the left, configuration options in the middle, and technical details on the far side. I found the interface to be cryptic and unintuitive at times.

Webroot detected and disabled all active malware infections on our test PC, and it removed all traces of 60 percent of the samples (which sounds low, but was actually above average among the suites we tested). Webroot detected 93 percent of inactive rootkits (stealth malware that is used to hide other malware infections) and all active rootkits, though it left some behind, removing only 87 percent of rootkit samples. Norton Internet Security 2010, our top pick in the 2010 roundup, was able to detect and remove all rootkit samples.

The Webroot suite struggles to stop brand-new malware outbreaks. Although it detected all samples in our behavioral-analysis tests (which involve detecting malware based solely on how it acts), it blocked only 27 percent of the samples, and fell even further behind by completely removing a mere 13 percent of the samples. By comparison, Norton Internet Security 2010 achieved a perfect score for detection, blocking, and removal. This is an important test of how well a suite will be able to detect new, unknown malware outbreaks; Given how quickly malware advances, Webroot’s low scores in this test indicate it may not do a good job of protecting you from zero-day exploits.

That said, Webroot did reasonably well at detecting malware using traditional signature-based detection, finding 96.2 percent of samples. However, signature-based detection is not as important as it once was, with proactive detection measures becoming more vital.

Webroot generally had a low impact on system performance, though bootup time (48.4 seconds) was a little on the slow side compared with the average of all suites that we tested. However, on two performance tests (repeatedly copying a file and creating a file) Webroot took longer to complete the task than virtually any other suite in our roundup. Webroot’s scan speeds were on the slow side too: it scanned 4.5GB of data in 5 minutes, 34 seconds in our on-access scan test that helps judge how well a product can scan files for malware when they are opened or saved to disk. By comparison, our top performer in this test completed it in 2 minutes, 51 seconds.

Webroot does offer free technical support by phone, but only on weekdays from 7 a.m. to 6 p.m. Mountain Time. Even the company’s Twitter-based tech support has limited hours. The company also offers PDF versions of the suite’s manual online, as well as a video tutorial for the installation process.

Webroot does well at traditional antivirus and antispyware detection, but we think the times demand strong protection against new threats that can’t be detected in the traditional ways. In those areas, Webroot’s performance just isn’t good enough for us to recommend.