Norton Internet Security
Encyclopedia
Norton Internet Security, developed by Symantec Corporation
, provides malware
prevention and removal during subscription period and uses signatures and heuristics to identify viruses
. Other features include a software firewall
, e-mail spam
filtering, and phishing
protection.
Symantec distributes the product as a download, a box copy, and as OEM software. Norton Internet Security held a 61% market share in the US retail security suite category in the first half of 2007. In this study, competitors, in terms of market share, included security suites from CA, Trend Micro
, and Kaspersky Lab
.
from Peter Norton
. Norton and his company developed various applications for DOS
, including an antivirus. Symantec continued the development of the acquired technologies, now marketed under the name of "Norton", with the tagline
"from Symantec". Norton's crossed-arm pose, a registered U.S. trademark, was featured on Norton product packaging. However, his pose was later moved to the spine of the packaging, and later dropped altogether.
Existing users of the 2006, 2007, 2008 or 2009 versions can upgrade to the latest version of the Norton software without buying a new subscription. The upgraded product, in this case Norton Internet Security 2011, uses the number of days left on a user's subscription.
protection and content control filters. Its release followed an alliance between Internet provider Excite@Home and antivirus vendor McAfee.com to provide Internet subscribers with McAfee's new firewall software, McAfee Personal Firewall. Version 2000's firewall, based on AtGuard from WRQ, filters traffic at the packet level. It can block ActiveX
controls and Java applets. Other functionalities include cookie
removal, and banner ad blocking. ZDNet
found the ad blocker removed graphics that were not ads, breaking pages. Adjusting the settings fixed the problem, however the process was complicated. ZDNet
noted the lack of information presented concerning attacks the firewall blocked. Norton LiveUpdate
downloads and installs program updates.
The Family Edition adds parental controls. Parental controls are backed by a quality control
team of 10 searching the web for inappropriate content. Found content is categorized in subject matter and placed on a blacklist of about 36,000 sites. A designed administrator can add blocked sites, however the pre-supplied blacklist cannot be viewed or edited since it is hard code
d. Administrators can block certain subject matters. Another option is to block all sites, then create a whitelist of allowed sites. Family Edition can also block transmission of specified personal information. Such information is replaced with the letter "X". However, CNN
noted X-rated
sites are retrieved when personal information is queried by a search engine
.
in addition to the Windows 9x
series, Windows NT
, and Windows 2000
. Following attacks by the ILOVEYOU
and Anna Kournikova
script
viruses, this version can block malicious scripts without virus signatures, but by analyzing behavior.
The firewall scans for Internet-enabled applications and creates access rules based on a knowledge base maintained by Symantec during installation. In PC Magazine
testing, the installation took 24 minutes to complete on a 750 MHz Pentium III with 92 Internet-enabled applications. Using the firewall, users can determine whether to accept cookies, Java applets, and ActiveX controls on a global or per-site basis. A new feature, Intrusion Detection with AutoBlock, can detect port scans and block further intrusion attempts. The program provides notifications for intrusion attempts, stating the severity level and providing access to threat details. Alternatively, the firewall can put the computer in stealth, essentially hiding the system. Users can configure the security level, affecting the number of notifications. Testing conducted by PC Magazine using Shields Up
and Symantec's Security Check found that the firewall successfully stealthed all ports, hiding the computer from view. A leak test was conducted to see the firewall's ability to detect outbound connections. Each attempt was detected and the suite offered to block the attempts.
The Family Edition, like the prior version, includes parental controls and the information filtering feature. Parental controls come with a list of objectionable sites, separated into 32 categories. The list is updated every two weeks by Norton LiveUpdate
. Using the list alone, Norton only blocks sites present on the list. Consequently, Norton may not block sites until the next update. Parents can customize the list, adding or removing sites. A list of allowed sites can be created to restrict children to those specific sites. This version uses application blocking rather than protocol or port filtering to control Internet access. Children can be restricted in what applications they used to access the Internet. A parental controls profile can be set up for each child, and settings can be automatically configured based on their age group, whether they be a child, teenager, adult, or administrator. Internet usage and violations are noted in a report presented to parents. PC Magazine found that enabling parental controls added a minute to a computer's boot time.
. An installation requires a reboot, and afterwards the Security Assistant guides users through a questionnaire to best configure the settings. A problem CNET encountered when upgrading from the prior release was the loss of customized settings. PC Magazine found the default settings, aimed at avoiding frequent notifications, were somewhat permissive. Windows 95
support was also dropped.
Running a full scan complies a list of Internet-enabled applications. Users set permissions or accept Norton's default settings. The firewall detects and blocks port scans and logs intrusion attempts. This version does not run a trace on attackers, however Symantec is planning an online tool to do so. To ensure rogue programs can not masquerade as trustworthy applications, Norton verifies programs against a list of digital signatures for known programs, updated every two weeks. The Norton Alert Tracker warns users if hackers attempt to gain access to users' computers. The firewall blocked all access attempts from Shields Up
and Port Checker. This version includes a wizard to simplify firewall setup to accommodate for multiple computers sharing an Internet connection. With this release, Norton can prevent specified personal information from being transmitted via a compatible instant messenger client, e-mail, and websites. Ad-blocking includes the Ad Trashcan, where users can place ads that slipped past ad-filtering.
A Professional Edition was announced December 11, 2001, with marketing aimed towards business owners. This version features Norton Intrusion Detection
, which intercepts suspicious connections and attacks, such as the Code Red
worm. Intrusion Detection focuses on Windows-based attacks only. Central management is also present in this version. Administrators configure firewall and productivity settings for client computers. Productivity settings allow administrators to block newsgroup
s, website
s, and advertisements. The suite integrates with XP user accounts; settings can be personalized for each user.
. Spam filtering scans the whole message and its context, rather than looking for keywords to ensure accuracy. A POP3 client must be used. When a message is identified as spam, Norton inserts an identifier, by default it is "Spam Alert:", in the subject line. Using the mail client, users can create a rule to delete or move flagged messages. Users can also create strings of text for Spam Alert to look for when classifying e-mail. In PC Magazine
testing, Spam Alert mistakenly classified 2.8 percent of legitimate e-mail as spam
. 47 percent of spam slipped passed the filter. Although misidentification of valid e-mail was low, the feature did not fare well at finding actual spam.
The updated main interface has green and red indicators to show which features are active and which need attention. The firewall has several updated features in this version. A Block Traffic button present in the main interface blocks all incoming and outgoing Internet traffic. Another new feature, the Visual Tracker, graphically maps attacks back to their origin. The firewall blocked all port scans conducted by CNET, stealthing each port.
Following the Nimda and Code Red worms, this version scans all incoming and outgoing traffic for suspicious data exchanges against a routinely updated database, a feature ported from Norton Internet Security 2002 Professional Edition. Connections to the offending computer is automatically severed if the traffic matches a database item.
Symantec announced a Professional Edition on November 19, 2002. Data recovery tools in this version allow users to recover deleted or malware damaged files. The inclusion of a data erasure
tool allows users to delete files while minimizing the chance of recovery. Web Cleanup removes browser cache files, history, and cookies. To maintain dial-up connections, Connection Keep Alive simulates online activity during periods of user inactivity. Norton Productivity Control enables users to filter Internet content and block newsgroups. When used with the User Access Manager, multiple filtering profiles can be created, assigned to different users.
, spyware
, and keylogger protection. PC Magazine
found the added protection to be weak. Out of the spyware samples Norton detected, a significant number were not removed completely, requiring manual removal. Norton also did little to prevent spyware infections.
Norton AntiSpam, the renamed spam filtering feature, has a set of spam rules, which cannot be viewed or edited. Whitelists and blacklists of senders can be created. Users may also create their own spam definitions. AntiSpam integrates with Outlook
, Outlook Express
, and Eudora
, allowing users to tag e-mail as spam on-the-fly. E-mail identified as spam are either quarantined by default, however the feature can be configured to delete such messages automatically. In CNET
testing, AntiSpam correctly identified 94 percent of spam messages.
Product activation
was introduced in this release. After installation, users are allowed a 15 day grace period to activate their copy of Norton Internet Security 2004. The program will not work after the deadline without the 24-character product key. The product key used to activate a copy of Norton Internet Security ties in with an alphanumeric
code based on a computer's hardware configuration. Users may activate their product five times with the same product key, however licensing terms dictate users are allowed only to install Norton Internet Security 2004 on one computer.
and PC Magazine noted lengthy scan times. A full scan took 24 minutes to over half an hour, respectively. IN PC Pro testing, Norton detected 61 percent of the spyware samples, compared to an average of 68 percent for all the tested products. Removal rates were above average, 72 percent verses the average of 68 percent. Norton blocked reinstallation with a score of 48 percent, compared to the group average of 43 percent. Overall, Norton ranked fifth among the tested products. In PC Magazine testing, Norton installed slowly on infected systems and failed to install on one altogether. Contacting Symantec did not resolve the issue.
Other new features include Internet Worm Protection to block worms, which scan IP addresses for open ports. It also blocks inbound ports based on known and suspected exploits using signatures and heuristics. The addition of the feature follows MSBlast in 2003 and Sasser
in 2004, worms that exploited vulnerability
in Microsoft Windows' operating systems. In response to emerging privacy threats — 75 percent of the threats in the last 12 months attempted to steal confidential information — this version adds phishing
protection. Using the firewall component, users can create a whitelist of sites where confidential information can be transmitted. Users are alerted when information is transmitted to a site not on the list. The Outbreak Alert feature warns users of major threats as classified by Symantec, and users can press the Fix Now button to applies a set of changes to close vulnerabilities, such as blocking necessary ports used by a propagating worm. The Browser Privacy can suppress information website generally receive about its visitors, such as the browser and operating system used. The feature can also block advertisements.
Privacy Control can warn users when sending confidential information. It can also be configured to block the transmission. It allows users to specify how the information can sent, such as via IM or e-mail. Item-specific exceptions allow users to control where there data can be sent. However, PC Pro found a flaw in the information filtering feature. The way information is formatted on the list of confidential information can affect its effectiveness. For example, entering the last six digits of a credit card number will not stop the numbers from leaking if they are grouped in four digits. PC Magazine also noted the fact anyone who can login to the computer can view the database of private information. For that reason, Symantec recommends entering only the last portion of sensitive information.
Norton AntiSpam now scans e-mails for spoofed URL
s and deals with any offending e-mail as spam. E-mails can also be blocked based on language, however by default the filter allows all languages. AntiSpam can sync its own list of allowed senders with POP3 address books. Users can train the spam filter by pointing out valid e-mail marked as spam and vice versa. Support for Yahoo! Mail
and Hotmail
was added in this release.
Norton Internet Security 2006 debuted on September 26, 2005. The new main interface, the Norton Protection Center, aggregates all information in a central location. Security status is shown by how secure the computer is for tasks such as e-mail and Internet browsing, not in the context of which features are enabled. The Protection Center can also recognize third-party software protecting the computer. The new interface advertises additional products from Symantec; some categories of protection, such as "Data Protection", will read "No Coverage" until the user purchases and installs Norton SystemWorks
. An additional system tray icon is created by the Protection Center.
The installation was noted as lengthy by PC Magazine, especially on malware-infected systems. Spyware detection has been tweaked since the last release. It has been updated to better identify keyloggers. In PC Magazine testing, Norton successfully detected all 11 spyware threats and removed all but two. PC Magazine did give Norton credit even when manual removal was required. The suite also removed three of four commercial keyloggers. When attempting to install the spyware on a clean system, Norton blocked all 11 and two of the four commercial keyloggers. In most cases, it did not block the installation, however Norton did call for a scan after the spyware was installed. In PC Pro testing, Norton detected 78 percent of spyware, removed 82 percent, and blocked 65 percent from installing.
Norton AntiSpam was discontinued as a separate product from Symantec, now only available in Norton Internet Security. The feature can block all e-mail from unknown senders, and automatically blocks messages with suspicious elements such as invisible text, HTML forms, and phishing URLs. To improve accuracy, Norton analyzes outgoing e-mails and messages whose categorization is corrected by users by hitting the This is spam and This is not spam buttons. In PC Magazine testing, the feature marked one in ten valid e-mail as spam and let one in every six spam messages in the inbox. 400 messages were used, and the program was allowed to process the messages for over a week. In PC Pro testing, the feature performed better, blocking 96 percent of spam, with a false positive rate of 0.2 percent.
Norton recommends disabling the Windows Firewall
to avoid redundant alerts. The firewall stealthed all significant ports in PC Magazine testing. Attacking the firewall itself was unsuccessful, PC Magazine was unable to stop its service
, terminate its process, or disable the firewall using simulated mouse clicks. The firewall also passed PC Pro's tests, successfully stealthing all ports.
Other features include Bloodhound technology, which looks for virus-like behavior to better find zero day virus
es. The Security Inspector looks for common vulnerabilities, including insecure user account passwords and browser insecurities. Advertisement blocking rewrites a website's HTML
to prevent advertisements from being displayed. Parental controls, an optional component, can block certain programs from accessing the Internet
, such as IM clients, and restrict newsgroup access. Restrictions can be assigned to different Windows users accounts. Sites are classified in 31 categories, and the four profiles which can be assigned each block different categories of sites. Supervisors define exceptions, add global blocked sites, or block all access to sites not on a user-created whitelist. Both PC Magazine and PC Pro noted the exclusion of time-based restrictions. Information filtering can be controlled on a per-user basis.
Windows 98
compatibility was dropped from this release.
open. Symantec revised Norton Internet Security and made this version more modularized, which has reduced the suite's memory usage to 10–15 megabytes and scan times by 30–35 percent. Another result is that spam filtering and parental controls are separate components to install. When installed, the features consume 100 MB of disk space.
Anti-phishing integrates with Internet Explorer
. It analyzes sites, examining the website's URL, title, form, page layout, visible text and links, and uses a blacklist to detect phishing sites. Users are blocked access from suspected phishing sites, however are presented an option to continue. In PC Magazine testing, the feature blocked 22 of 24 phishing sites, while Internet Explorer 7
recognized 17 of the 24 sites. In PC Pro testing, the feature successfully blocked access to every phishing site it was tested against. Spam filtering no longer includes a language feature, Symantec claims it is less useful with current spam and created false positives. Tested against 1500 messages by PC Magazine, Norton let over half of the spam to the inbox. Five percent of valid mail were marked as spam. This version utilizes Symantec's Veritas
VxMS technology to better identify rootkit
s. VxMS allows Norton to find inconsistencies among files within directories and files at the volume level. A startup application manager allows users to prevent applications from launching at login. This release drops support for Windows 2000 and was be compatible with Windows Vista upon its release with an update.
The firewall makes all decisions by itself to lessen the chance of being weakened by a misinformed decision. Applications known to be safe are allowed Internet access, and vice versa for malicious applications. Unknown ones are analyzed and blocked if they exhibit malicious behavior. In both PC Magazine and PC Pro testing, the firewall did not incorrectly block any safe applications from Internet access. All malware was blocked by the firewall. PC Magazine testing reflected the same results. The firewall also stealthed all ports. Exploits were blocked by the intrusion prevention system, which prevents threats from leveraging vulnerabilities. The system is updated whenever a vulnerability is identified for Windows-based computers. Attempts to disable the firewall were unsuccessful; registry changes, process termination, and simulated mouse clicks all failed. Disabling Windows services had no effect on the firewall since it works at the kernel driver level. This version automatically adjusts configuration for different networks based on the physical address
of the gateway rather than IP addresses.
In PC Magazine testing, Norton detected 15 of 16 spyware samples. 13 of the 16 were removed. Against eight commercial keyloggers, the suite removed all the samples. On a clean system, Norton blocked 14 of the 16 spyware samples from installing, and stopped seven of the eight keyloggers from installing.
, the Norton Identity Safe, and Browser Defender. SONAR monitors applications for malicious behavior. The Identity Safe supersedes the information filtering function; instead of blocking personal information from leaving the computer, it stores personal information to fill webforms. It is password protected and checks a website's authenticity before filling any forms. Browser Defender inspects and blocks suspicious API calls, intended to stop drive-by download
s. The Network Map identifies networked computers with Norton Internet Security 2008 installed. Remote monitoring allows checking the status of other installations on different computers; problems are identified with a red "X" icon. Using the feature, users also can control network traffic between computers. It also warns users if they are using an unencrypted wireless network. The startup application manager and advertisement blocking features were dropped from this release. Information filtering, although superseded by the Identity Safe in the suite, is available separately. It can be used in conjunction with the Identity Safe.
Phishing protection now integrates with Mozilla Firefox
. Testing by PC Magazine found that Norton blocked 94 percent of phishing sites, compared to 83 percent for Internet Explorer 7
and 77 percent for Firefox 2
. CNET identified an issue with the feature; when anti-phishing is disabled, the Identity Safe still offers users to automatically submit personal information to websites, including phishing sites. Symantec declined to call it a "flaw", stating it is recommended to use the Identity Safe with anti-phishing enabled. Alternatively, the Identity Safe could be used with Firefox and Internet Explorer's built-in anti-phishing capability.
PC Magazine found that the firewall put all ports in stealth mode. The firewall blocked ten of 12 leak tests, used to see if malware can evade the firewall's control of network traffic. Previous versions did not identify the tests because none carried a malicious payload. Another test was conducted using Core Impact, which successfully exploited one vulnerability on the test computer. However, other components of Norton stopped the exploit from causing harm. The other attempts were unsuccessful either because the system was invulnerable or Norton's Intrusion Prevention System stopped it. Attempts to disable the firewall were unsuccessful by PC Magazine. On the contrary, PC Pro identified 15 open ports on a computer with Norton installed.
In PC Magazine testing, Norton completely detected most of the malware samples. For two-thirds of the samples, all traces were removed. Norton found and removed all the commercial keyloggers. A full scan took nearly an hour to complete though, twice as long as the 2007 version. The suite blocked most of the malware from installing and all the commercial keyloggers, regardless of any modifications made to the samples. PC World noted that Norton removed 80 percent of malware-associated files and Registry
entries.
Spam filtering imports users' address books to compile a whitelist of allowed senders. Addresses to which users send mail and e-mail tagged as valid mail can be automatically added to the whitelist. Using several thousand messages, PC Magazine found that Norton marked over 40 percent of valid e-mail as spam. Over 80 percent of valid newsletters were marked as spam. Norton did correctly identify 90 percent of spam e-mail.
The 2009 version was released for sale September 9, 2008. Symantec set several goals for version 2009 while in development: complete installations under minute and a footprint of 100 MB. Average installation times range from eight to ten minutes, and the previous 2008 version had a 400 MB footprint. Other goals included reducing load time after the computer starts, from 20–30 seconds to 10 seconds, and file scanning times with a technology allowing Norton to skip certain trusted files. The technology works on the basis that if a piece of software runs on a significant proportion of computers, then it is safe.
A public beta was released July 14. A reduction in memory consumption was made, prompted by the fact 40 percent of people contacting Symantec support had 512 MB of RAM. The beta uses about 6 MB of memory, compared to 11 MB by the prior version. To reduce scan times, Norton Insight
uses data from Norton Community participants to avoid scanning files that are found on a statistically significant amount of computers. Citing a NPD Group
study finding that 39 percent of consumers switching antiviruses blamed performance, a CPU usage meter will be available within the final product to allow users to find the cause of high CPU usage, whether it be Norton or another program. This version features more frequent updates, a change called Norton Pulse Updates. Rather than deliver an update every eight hours, as the 2008 version does, Pulse Updates are delivered five to fifteen minutes. The Silent Mode automatically suspends alerts and updates when a program enters fullscreen mode and can be manually enabled. The suite's activities take place while the computer is idle, and terminate once user activity is registered. The final release (16.5) bundles spam filtering, which used to be a free download from Symantec. This release also bundles Norton Safe Web
, which identifies malicious websites, compatible with Internet Explorer and Firefox. Norton Safe Web
color codes search results from famous search engine such from Google
and Yahoo for safety. The Norton Safe Web
toolbar also includes an Ask.com search box. The search box does not share code with the Ask toolbar; instead the box redirects queries to the Ask search engine. Norton Safe Web is compatible with Internet Explorer and Firefox. Norton Safe Web.
Benchmarking
conducted by PassMark Software highlights the 2009 version's 52 second install time, 32 second scan time, and 7 MB memory utilization. Symantec funded the benchmark test and provided scripts used to benchmark each participating antivirus software
. Tests were conducted in Windows Vista running on a dual core processor. PC Magazine found the suite added 15 seconds to the boot time, with a baseline of 60 seconds. Norton added less than 5 percent to the time it takes to complete file operations. 25 percent more time was taken to unzip and zip a set of files.
In PC Magazine testing, Norton removed most traces of 40 percent of the malware. On a similar test, specifically using commercial keyloggers, Norton was able to remove most of the keyloggers, beating other tested products. Norton blocked all attempts to install malware on a clean system. Modifications made to the samples did not fool Norton. Norton was not able to block the installation of all the commercial keyloggers.
Phishing protection blocked 90 percent of verified phishing websites in PC Magazine testing. Internet Explorer 7 caught 75 percent, and Firefox caught 60 percent.
Norton stealthed all ports, according to PC Magazine. Port scans were unsuccessful. The firewall blocked all exploit attempts by Core Impact.
Malware blocking and removal garnered good results PC Magazine testing. All but one malware samples contained within a folder were removed once the folder was opened. The last one was removed when executed. Modifications made to the samples did not affect detection. On a similar test, specifically using commercial keyloggers, Norton did not successfully detect all. In removing threats, Norton almost completely removed 40 percent of the malware samples and related executables. Norton was also able to remove more commercial keyloggers than any other product.
Other facets of Quorum are parental controls and spam filtering. Norton Internet Security 2010 bundles a free subscription of OnlineFamily.Norton
, which PC Magazine found to be an improvement over the parental controls bundled with prior releases. Spam filtering uses technologies Symantec acquired from Brightmail
. Two filters are used to find spam: a locally installed one and a check against Symantec's servers to see if the message is known spam. In PC Magazine
testing, no valid e-mail were marked as spam. However, 11 percent of spam still made it to the inbox. This was a significant improvement over prior releases. Another improvement to the product is the improved heuristic feature called SONAR 2. It leverages reputation data to judge if a program is malicious or clean. Norton Insight has also been expanded, showing users the number of Norton Community participants who have a certain program installed, its impact of system resources, and how long it has been released. Information about the program's origin and a graph of its resource usage is also provided. A new feature codenamed Autospy helps users understand what Norton did when malware was found. The malware's actions and Norton's resolution are presented to the user. Previous releases removed threats on sight and quietly warned users, potentially confusing when users are deceived in downloading rogue security software.
Another addition to the product is the new "Flip Screen". With a compatible graphics card, the main display "flips over" to show the opposite side of the main interface, consisting of a chart of CPU or memory usage and a timeline of security events. Without one, the "Flip Screen" link is replaced by a "back" link, which opens the back of the windows as a separate window.
The product also adds a search engine labeled "Safe Search". The custom search allows the user to filter out unsafe sites, get insight on them, and keep track of cookies.
Malware removal and blocking performed well, setting or meeting records in PC Magazine testing. It achieved a detection rate of 98%. The highest out of 12 tested antivirus products. The exception was blocking commercial keyloggers, where Norton made an above average score. File operations took 2 percent longer, and the file compression and extraction test took 4 percent longer. The only area where Norton introduced a significant delay was when the system was booting, the beta version of the suite added 31 percent to the boot time, significantly longer than prior versions. According to the Norton performance comparison website, Norton Internet Security scans 31 percent faster, is 70 percent lighter, and installs 76 percent faster than the leading Anti-virus product. According to av-comparatives, http://www.av-comparatives.org Norton Internet Security was "Best Product of 2009", Bronze award for 98.6% detection rate in 2010 and Norton Internet Security 2010 blocked 99/100 internet threats from infecting the user's computer.
also released an application that "scans" the user's Facebook
feed for any malware links. This application does not require a valid subscription. In a test sponsored by Symantec, Norton Internet Security 2011 was the only security suite to ever achieve a 100 percent protection score in a new third-party test from Dennis Labs. Improved reputation scan provides the user with an easy to understand interface on files stored on the user's computer. Marking them as trusted, good, poor, or bad. The final version of Norton Internet Security 2011 was released on August 31, 2010. New features in version 2011 also include Norton Rescue Tools. These tools include Norton Bootable Recovery tool and Norton Power Eraser.
On December 9, 2010, Symantec released the 18.5 version through Norton LiveUpdate
. However, this update was later pulled due to numerous reports on the Norton forums that the update is causing system instability and freeze ups during system scans (both full and quick scans). This issue only affect some customers. Users affected by this update are advised to uninstall the product, run the Norton Removal Tool, and reinstall the 18.1 version from http://www.norton.com/nis11. Norton later fixed the bugs and re-released the update.
The new product features a new Norton logo which uses the VeriSign checkmark formerly seen in VeriSign's own logo, as well as several new icon changes to the Norton Safe Web
and Norton Identity Safe features.
2.0, which not only monitor files for safety but also the stability of a given file. That means that If a file is stable on Windows 7, but unstable on Windows XP, XP users will be notified for the instability of the file.
Also, integration with specialised removal tools is added, for better cleanup of already infected systems. A new smaller and more effective version of Norton power eraser is launched to assist in removal of fake antivirus software and other deeply-embedded threats that are otherwise hard to remove. A new tool called Norton Management helps manage different computers and devices equipped with Norton software from a single location.
Another feature added with this release is Sonar 4
. Another welcome change is that identity Safe and Safe Web
are finally compatible with Google Chrome
and all the passwords and notes can be stored in the cloud should the user wish.
The user interface is also simplified with only 3 buttons. The 3rd button opens a more advanced and complicated UI, where the user is able to manage settings and access different product features. The CPU meter, a long-time supported and loved feature, that was removed from Norton 2011, also makes a return (only on the "advanced screen").
Combining the netbook and desktop line, Norton Internet Security integrates Bandwidth metering, which controls product's traffic usage and takes it down to minimum if necessary. This is ideal for networks with limited traffic. Also, the user interface window adjust accordingly to the size of the computer screen.
This version of Norton Internet Security includes several easter eggs. Pressing Shift+1, 2, 3 or 4 would change the theme to default background (plain black), ray, animals, and floral respectively. Also holding CTRL + WinKey + Alt while pressing "performance buton
" to activate "Crazy Flip", which will make the window flip head over heels. The effect would continue until the main window is closed and reopened.
In addition, scans are no-longer scheduled through the Windows Task Scheduler
, but through the Symantec's more advanced one, which waits for the user to stop using the keyboard and mouse (e.g. leaves the PC) and then performs tasks.
has released a special edition of Norton Internet Security optimized for Netbooks. This is available as download from the Symantec website or in a USB thumb drive.
version of Norton Internet Security, which is distributed on a thumb drive. This special Netbook edition is also available as a download from the Symantec
website.
. Other features include a firewall, advertisement blocking in the browser
, parental controls, and the ability to prevent confidential information from being transmitted outside the computer. Users are prompted before such information is able to be transmitted. The incorporation of Aladdin Systems'
iClean allows users to purge the browser cache, cookies
, and browsing history within Norton's interface. Operating system requirements call for Mac OS 8.1. Hardware requirements call for 24 MB of RAM, 12 MB of disk space, and a PowerPC
processor.
Version 2.0 also ties in with the WHOIS
database, allowing users to trace attacking computers. Users can inform network administrators of the attacking computers for corrective actions. When running under Mac OS 8.1 or 9
, a PowerPC processor, 24 MB of RAM, and 25 MB of free space is required. Under Mac OS X 10.1, a PowerPC G3
processor, 128 MB of RAM, and 25 MB of free space is required.
The subsequent release, version 3.0, maintained the feature set found in version 2.0. The firewall now allocates internet access as needed rather than relying on user input using predefined rules. Compatibility with OS 8 was dropped. When running under OS 9.2, a PowerPC processor, 24 MB of RAM, and 25 MB of free space is required. Under OS X 10.1.5 through 10.3, a PowerPC G3, 128 MB of RAM, and 150 MB of free space is required. However, version 3.0 is not compatible with OS X 10.4
, or "Tiger".
processor, 256 MB of RAM and 150 MB of free space are required.
According to PassMark Security Benchmark 2012 Norton AntiVirus and Norton Internet Security are the lightest suites available. Av-comparatives.org also tested these products and give similar results.
PCMag recognises 2011 and 2012 lines as the fastest and strongest in protection.
PCWorld's tests of security software put Norton Internet Security 2009 on the 1-st place.
In 2011's test of PCWorld Norton Internet Security was the winner. Av-test.org certifies Norton, putting it on a second place after BitDefender. Many other reputable sources like Dennis Technology Labs confirm the performance and effectivness of Norton 2011 and 2012 lines.
(FBI), whitelisted Magic Lantern
, a keylogger
actively developed by the FBI. The purpose of Magic Lantern is to obtain passwords to encrypted e-mail as part of a criminal investigation. Magic Lantern was first reported in the media by Bob Sullivan
of MSNBC
on November 20, 2001 and by Ted Bridis of the Associated Press
. Magic Lantern is deployed as an e-mail attachment
. When the attachment is opened, a trojan horse
is installed on the suspect's computer. The Trojan horse is activated when the suspect uses PGP
encryption, often used to increase the security of sent e-mail messages. When activated, the trojan horse will log the PGP password, which allows the FBI to decrypt user communications. Symantec and other major antivirus vendors have whitelisted Magic Lantern, rendering their antivirus products, including Norton Internet Security, incapable of detecting Magic Lantern. Concerns include uncertainties about Magic Lantern's full potential and whether hackers could subvert it for purposes outside the jurisdiction of the law.
Graham Cluley, a technology consultant from Sophos
, said "We have no way of knowing if it was written by the FBI, and even if we did, we wouldn’t know whether it was being used by the FBI or if it had been commandeered by a third party". Another reaction came from Marc Maiffret, chief technical officer
and cofounder of eEye Digital Security, "Our customers are paying us for a service, to protect them from all forms of malicious code. It is not up to us to do law enforcement's job for them so we do not, and will not, make any exceptions for law enforcement malware or other tools."
FBI spokesman Paul Bresson, in response if Magic Lantern needed a court order to deploy, "Like all technology projects or tools deployed by the FBI it would be used pursuant to the appropriate legal process."
Proponents of Magic Lantern argue the technology would allow law enforcement to efficiently and quickly decrypt messages protected by encryption schemes. Implementing Magic Lantern does not require physical access to a suspect's computer, unlike Carnivore, a predecessor to Magic Lantern, since physical access to a computer would require a court order.
Symantec reports that Norton 2010 range of products feature a cleaner uninstall and over-installs is the recommended update route to 2011.
keys being added by a tool named fixcss.exe, resulting in an empty Device Manager and missing devices such as wireless network adapters. Symantec initially blamed Microsoft for the incompatibilities but has since accepted partial responsibility.
Dave Cole, Symantec's senior director of product management, acknowledged that users running Norton products were experiencing problems, but said the numbers are small. Cole also said that Symantec had done "extensive testing" of its products with Windows XP SP3, but this issue was not encountered. Cole blamed Microsoft "This is related to XP SP3." Microsoft recommended that users contact Windows customer support. To resolve the problem, Symantec has issued a fix intended for users before upgrading. Symantec also recommends disabling the tamper protection component in the 2008 release, dubbed SymProtect. A tool to remove the added registry entries is also available from Symantec.
feature. PatchGuard was designed by Microsoft to ensure the integrity of the kernel
, a part of a operating system
which interacts with the hardware. Rootkit
s often hide in a operating system's kernel, complicating removal. Mike Dalton, European president of McAfee
said, "The decision to build a wall around the kernel with the assumption it can't be breached is ridiculous", claiming Microsoft was preventing security vendors from effectively protecting the kernel while promoting its own security product, Windows Live OneCare
. Hicks said Symantec did not mind the competition from OneCare. Symantec later published a white paper detailing PatchGuard with instructions to obtain a PatchGuard exploit. After negotiations and investigations from antitrust regulators, Microsoft decided to allow security vendors access to the kernel by creating special API
instructions.
will have to get the 2010 or later version. Versions 2005 and older are not eligible for the upgrade or a patch.
Symantec
Symantec Corporation is the largest maker of security software for computers. The company is headquartered in Mountain View, California, and is a Fortune 500 company and a member of the S&P 500 stock market index.-History:...
, provides malware
Malware
Malware, short for malicious software, consists of programming that is designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, or gain unauthorized access to system resources, or that otherwise exhibits abusive behavior...
prevention and removal during subscription period and uses signatures and heuristics to identify viruses
Computer virus
A computer virus is a computer program that can replicate itself and spread from one computer to another. The term "virus" is also commonly but erroneously used to refer to other types of malware, including but not limited to adware and spyware programs that do not have the reproductive ability...
. Other features include a software firewall
Personal firewall
A personal firewall is an application which controls network traffic to and from a computer, permitting or denying communications based on a security policy. Typically it works as an application layer firewall....
, e-mail spam
E-mail spam
Email spam, also known as junk email or unsolicited bulk email , is a subset of spam that involves nearly identical messages sent to numerous recipients by email. Definitions of spam usually include the aspects that email is unsolicited and sent in bulk. One subset of UBE is UCE...
filtering, and phishing
Phishing
Phishing is a way of attempting to acquire information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popular social web sites, auction sites, online payment processors or IT...
protection.
Symantec distributes the product as a download, a box copy, and as OEM software. Norton Internet Security held a 61% market share in the US retail security suite category in the first half of 2007. In this study, competitors, in terms of market share, included security suites from CA, Trend Micro
Trend Micro
Trend Micro Inc. is a computer security company. It is headquartered in Tokyo, Japan and markets Trend Micro Internet Security, Trend Micro Worry-Free Business Security, OfficeScan, and other related security products and services...
, and Kaspersky Lab
Kaspersky Lab
Kaspersky Lab is a Russian computer security company, co-founded by Natalia Kaspersky and Eugene Kaspersky in 1997, offering anti-virus, anti-spyware, anti-spam, and anti-intrusion products...
.
Windows edition
In August 1990 Symantec acquired Peter Norton ComputingPeter Norton Computing
Peter Norton Computing, Inc., was a software company founded by Peter Norton. The first and most notable software package it produced is the Norton Utilities. Another very popular software was Norton Commander, especially the DOS version. In 1990, the company was acquired by Symantec. The...
from Peter Norton
Peter Norton
Peter Norton is an American programmer, software publisher, author, and philanthropist. He is best known for the computer programs and books that bear his name. Norton sold his PC-Software business to Symantec Corporation in 1990....
. Norton and his company developed various applications for DOS
DOS
DOS, short for "Disk Operating System", is an acronym for several closely related operating systems that dominated the IBM PC compatible market between 1981 and 1995, or until about 2000 if one includes the partially DOS-based Microsoft Windows versions 95, 98, and Millennium Edition.Related...
, including an antivirus. Symantec continued the development of the acquired technologies, now marketed under the name of "Norton", with the tagline
Tagline
A tagline is a variant of a branding slogan typically used in marketing materials and advertising. The idea behind the concept is to create a memorable phrase that will sum up the tone and premise of a brand or product , or to reinforce the audience's memory of a product...
"from Symantec". Norton's crossed-arm pose, a registered U.S. trademark, was featured on Norton product packaging. However, his pose was later moved to the spine of the packaging, and later dropped altogether.
Existing users of the 2006, 2007, 2008 or 2009 versions can upgrade to the latest version of the Norton software without buying a new subscription. The upgraded product, in this case Norton Internet Security 2011, uses the number of days left on a user's subscription.
Version 2000 (1.0)
Norton Internet Security 2000, released January 10, 2000, was Symantec's first foray beyond virusComputer virus
A computer virus is a computer program that can replicate itself and spread from one computer to another. The term "virus" is also commonly but erroneously used to refer to other types of malware, including but not limited to adware and spyware programs that do not have the reproductive ability...
protection and content control filters. Its release followed an alliance between Internet provider Excite@Home and antivirus vendor McAfee.com to provide Internet subscribers with McAfee's new firewall software, McAfee Personal Firewall. Version 2000's firewall, based on AtGuard from WRQ, filters traffic at the packet level. It can block ActiveX
ActiveX
ActiveX is a framework for defining reusable software components in a programming language-independent way. Software applications can then be composed from one or more of these components in order to provide their functionality....
controls and Java applets. Other functionalities include cookie
HTTP cookie
A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site...
removal, and banner ad blocking. ZDNet
ZDNet
ZDNet is a business technology news website published by CBS Interactive, along with TechRepublic and SmartPlanet. The brand was founded on April 1, 1991 as a general interest technology portal from Ziff Davis and evolved into an enterprise IT-focused online publication owned by CNET...
found the ad blocker removed graphics that were not ads, breaking pages. Adjusting the settings fixed the problem, however the process was complicated. ZDNet
ZDNet
ZDNet is a business technology news website published by CBS Interactive, along with TechRepublic and SmartPlanet. The brand was founded on April 1, 1991 as a general interest technology portal from Ziff Davis and evolved into an enterprise IT-focused online publication owned by CNET...
noted the lack of information presented concerning attacks the firewall blocked. Norton LiveUpdate
Norton LiveUpdate
Norton LiveUpdate is an application developed by Symantec Corporation that downloads and installs security updates and software patches. LiveUpdate can only apply updates for a particular version of Norton; it cannot however upgrade a version of Norton to a later version...
downloads and installs program updates.
The Family Edition adds parental controls. Parental controls are backed by a quality control
Quality control
Quality control, or QC for short, is a process by which entities review the quality of all factors involved in production. This approach places an emphasis on three aspects:...
team of 10 searching the web for inappropriate content. Found content is categorized in subject matter and placed on a blacklist of about 36,000 sites. A designed administrator can add blocked sites, however the pre-supplied blacklist cannot be viewed or edited since it is hard code
Hard code
Hard coding refers to the software development practice of embedding what may, perhaps only in retrospect, be regarded as input or configuration data directly into the source code of a program or other executable object, or fixed formatting of the data, instead of obtaining that data from external...
d. Administrators can block certain subject matters. Another option is to block all sites, then create a whitelist of allowed sites. Family Edition can also block transmission of specified personal information. Such information is replaced with the letter "X". However, CNN
CNN
Cable News Network is a U.S. cable news channel founded in 1980 by Ted Turner. Upon its launch, CNN was the first channel to provide 24-hour television news coverage, and the first all-news television channel in the United States...
noted X-rated
X-rated
In some countries, X is or has been a motion picture rating reserved for the most explicit films. Films rated X are intended only for viewing by adults, usually legally defined as people over the age of 17.-United Kingdom:...
sites are retrieved when personal information is queried by a search engine
Search engine
A search engine is an information retrieval system designed to help find information stored on a computer system. The search results are usually presented in a list and are commonly called hits. Search engines help to minimize the time required to find information and the amount of information...
.
Version 2001 (2.5)
Version 2001 was released September 18, 2000, adding support for Windows MEWindows Me
Windows Millennium Edition, or Windows Me , is a graphical operating system released on September 14, 2000 by Microsoft, and was the last operating system released in the Windows 9x series. Support for Windows Me ended on July 11, 2006....
in addition to the Windows 9x
Windows 9x
Windows 9x is a generic term referring to a series of Microsoft Windows computer operating systems produced since 1995, which were based on the original and later modified Windows 95 kernel...
series, Windows NT
Windows NT
Windows NT is a family of operating systems produced by Microsoft, the first version of which was released in July 1993. It was a powerful high-level-language-based, processor-independent, multiprocessing, multiuser operating system with features comparable to Unix. It was intended to complement...
, and Windows 2000
Windows 2000
Windows 2000 is a line of operating systems produced by Microsoft for use on personal computers, business desktops, laptops, and servers. Windows 2000 was released to manufacturing on 15 December 1999 and launched to retail on 17 February 2000. It is the successor to Windows NT 4.0, and is the...
. Following attacks by the ILOVEYOU
ILOVEYOU
ILOVEYOU, also known as Love Letter, is a computer worm that successfully attacked tens of millions of computers in 2000 when it was sent as an attachment to a user with the text "ILOVEYOU" in the subject line. The worm arrived e-mail on and after May 4, 2000 with the simple subject of "ILOVEYOU"...
and Anna Kournikova
Anna Kournikova (computer virus)
The Anna Kournikova computer virus was a computer virus authored by Dutch programmer Jan de Wit on February 11, 2001. It was designed to trick email users into opening a mail message purportedly containing a picture of tennis player Anna Kournikova, while actually hiding a malicious program...
script
Scripting language
A scripting language, script language, or extension language is a programming language that allows control of one or more applications. "Scripts" are distinct from the core code of the application, as they are usually written in a different language and are often created or at least modified by the...
viruses, this version can block malicious scripts without virus signatures, but by analyzing behavior.
The firewall scans for Internet-enabled applications and creates access rules based on a knowledge base maintained by Symantec during installation. In PC Magazine
PC Magazine
PC Magazine is a computer magazine published by Ziff Davis Publishing Holdings Inc. A print edition was published from 1982 to January 2009...
testing, the installation took 24 minutes to complete on a 750 MHz Pentium III with 92 Internet-enabled applications. Using the firewall, users can determine whether to accept cookies, Java applets, and ActiveX controls on a global or per-site basis. A new feature, Intrusion Detection with AutoBlock, can detect port scans and block further intrusion attempts. The program provides notifications for intrusion attempts, stating the severity level and providing access to threat details. Alternatively, the firewall can put the computer in stealth, essentially hiding the system. Users can configure the security level, affecting the number of notifications. Testing conducted by PC Magazine using Shields Up
Shields Up
Shields Up is an online port scanning service created by Steve Gibson of Gibson Research Corporation and hosted at . The purpose of this utility is to alert the users of any ports that have been opened through their firewalls or through their NAT routers...
and Symantec's Security Check found that the firewall successfully stealthed all ports, hiding the computer from view. A leak test was conducted to see the firewall's ability to detect outbound connections. Each attempt was detected and the suite offered to block the attempts.
The Family Edition, like the prior version, includes parental controls and the information filtering feature. Parental controls come with a list of objectionable sites, separated into 32 categories. The list is updated every two weeks by Norton LiveUpdate
Norton LiveUpdate
Norton LiveUpdate is an application developed by Symantec Corporation that downloads and installs security updates and software patches. LiveUpdate can only apply updates for a particular version of Norton; it cannot however upgrade a version of Norton to a later version...
. Using the list alone, Norton only blocks sites present on the list. Consequently, Norton may not block sites until the next update. Parents can customize the list, adding or removing sites. A list of allowed sites can be created to restrict children to those specific sites. This version uses application blocking rather than protocol or port filtering to control Internet access. Children can be restricted in what applications they used to access the Internet. A parental controls profile can be set up for each child, and settings can be automatically configured based on their age group, whether they be a child, teenager, adult, or administrator. Internet usage and violations are noted in a report presented to parents. PC Magazine found that enabling parental controls added a minute to a computer's boot time.
Version 2002 (5.0)
Version 2002 was announced August 28, 2001. The Family Edition was dropped, so parental controls and information filtering are bundled with this release. The installation was noted as quick and simple by both PC Magazine and CNETCNET
CNET is a tech media website that publishes news articles, blogs, and podcasts on technology and consumer electronics. Originally founded in 1994 by Halsey Minor and Shelby Bonnie, it was the flagship brand of CNET Networks and became a brand of CBS Interactive through CNET Networks' acquisition...
. An installation requires a reboot, and afterwards the Security Assistant guides users through a questionnaire to best configure the settings. A problem CNET encountered when upgrading from the prior release was the loss of customized settings. PC Magazine found the default settings, aimed at avoiding frequent notifications, were somewhat permissive. Windows 95
Windows 95
Windows 95 is a consumer-oriented graphical user interface-based operating system. It was released on August 24, 1995 by Microsoft, and was a significant progression from the company's previous Windows products...
support was also dropped.
Running a full scan complies a list of Internet-enabled applications. Users set permissions or accept Norton's default settings. The firewall detects and blocks port scans and logs intrusion attempts. This version does not run a trace on attackers, however Symantec is planning an online tool to do so. To ensure rogue programs can not masquerade as trustworthy applications, Norton verifies programs against a list of digital signatures for known programs, updated every two weeks. The Norton Alert Tracker warns users if hackers attempt to gain access to users' computers. The firewall blocked all access attempts from Shields Up
Shields Up
Shields Up is an online port scanning service created by Steve Gibson of Gibson Research Corporation and hosted at . The purpose of this utility is to alert the users of any ports that have been opened through their firewalls or through their NAT routers...
and Port Checker. This version includes a wizard to simplify firewall setup to accommodate for multiple computers sharing an Internet connection. With this release, Norton can prevent specified personal information from being transmitted via a compatible instant messenger client, e-mail, and websites. Ad-blocking includes the Ad Trashcan, where users can place ads that slipped past ad-filtering.
A Professional Edition was announced December 11, 2001, with marketing aimed towards business owners. This version features Norton Intrusion Detection
Intrusion detection
In Information Security, intrusion detection is the act of detecting actions that attempt to compromise the confidentiality, integrity or availability of a resource. When Intrusion detection takes a preventive measure without direct human intervention, then it becomes an Intrusion-prevention...
, which intercepts suspicious connections and attacks, such as the Code Red
Code Red (computer worm)
The Code Red worm was a computer worm observed on the Internet on July 13, 2001. It attacked computers running Microsoft's IIS web server.The Code Red worm was first discovered and researched by eEye Digital Security employees Marc Maiffret and Ryan Permeh...
worm. Intrusion Detection focuses on Windows-based attacks only. Central management is also present in this version. Administrators configure firewall and productivity settings for client computers. Productivity settings allow administrators to block newsgroup
Newsgroup
A usenet newsgroup is a repository usually within the Usenet system, for messages posted from many users in different locations. The term may be confusing to some, because it is usually a discussion group. Newsgroups are technically distinct from, but functionally similar to, discussion forums on...
s, website
Website
A website, also written as Web site, web site, or simply site, is a collection of related web pages containing images, videos or other digital assets. A website is hosted on at least one web server, accessible via a network such as the Internet or a private local area network through an Internet...
s, and advertisements. The suite integrates with XP user accounts; settings can be personalized for each user.
Version 2003
Version 2003 was announced September 16, 2002, scheduled to be available for purchase later that month. This version adds Norton Spam Alert to reduce e-mail spamE-mail spam
Email spam, also known as junk email or unsolicited bulk email , is a subset of spam that involves nearly identical messages sent to numerous recipients by email. Definitions of spam usually include the aspects that email is unsolicited and sent in bulk. One subset of UBE is UCE...
. Spam filtering scans the whole message and its context, rather than looking for keywords to ensure accuracy. A POP3 client must be used. When a message is identified as spam, Norton inserts an identifier, by default it is "Spam Alert:", in the subject line. Using the mail client, users can create a rule to delete or move flagged messages. Users can also create strings of text for Spam Alert to look for when classifying e-mail. In PC Magazine
PC Magazine
PC Magazine is a computer magazine published by Ziff Davis Publishing Holdings Inc. A print edition was published from 1982 to January 2009...
testing, Spam Alert mistakenly classified 2.8 percent of legitimate e-mail as spam
E-mail spam
Email spam, also known as junk email or unsolicited bulk email , is a subset of spam that involves nearly identical messages sent to numerous recipients by email. Definitions of spam usually include the aspects that email is unsolicited and sent in bulk. One subset of UBE is UCE...
. 47 percent of spam slipped passed the filter. Although misidentification of valid e-mail was low, the feature did not fare well at finding actual spam.
The updated main interface has green and red indicators to show which features are active and which need attention. The firewall has several updated features in this version. A Block Traffic button present in the main interface blocks all incoming and outgoing Internet traffic. Another new feature, the Visual Tracker, graphically maps attacks back to their origin. The firewall blocked all port scans conducted by CNET, stealthing each port.
Following the Nimda and Code Red worms, this version scans all incoming and outgoing traffic for suspicious data exchanges against a routinely updated database, a feature ported from Norton Internet Security 2002 Professional Edition. Connections to the offending computer is automatically severed if the traffic matches a database item.
Symantec announced a Professional Edition on November 19, 2002. Data recovery tools in this version allow users to recover deleted or malware damaged files. The inclusion of a data erasure
Data erasure
Data erasure is a software-based method of overwriting data that completely destroys all electronic data residing on a hard disk drive or other digital media. Permanent data erasure goes beyond basic file deletion commands, which only remove direct pointers to data disk sectors and make data...
tool allows users to delete files while minimizing the chance of recovery. Web Cleanup removes browser cache files, history, and cookies. To maintain dial-up connections, Connection Keep Alive simulates online activity during periods of user inactivity. Norton Productivity Control enables users to filter Internet content and block newsgroups. When used with the User Access Manager, multiple filtering profiles can be created, assigned to different users.
Version 2004
Announced September 8, 2003, version 2004 adds adwareAdware
Adware, or advertising-supported software, is any software package which automatically plays, displays, or downloads advertisements to a computer. These advertisements can be in the form of a pop-up. They may also be in the user interface of the software or on a screen presented to the user during...
, spyware
Spyware
Spyware is a type of malware that can be installed on computers, and which collects small pieces of information about users without their knowledge. The presence of spyware is typically hidden from the user, and can be difficult to detect. Typically, spyware is secretly installed on the user's...
, and keylogger protection. PC Magazine
PC Magazine
PC Magazine is a computer magazine published by Ziff Davis Publishing Holdings Inc. A print edition was published from 1982 to January 2009...
found the added protection to be weak. Out of the spyware samples Norton detected, a significant number were not removed completely, requiring manual removal. Norton also did little to prevent spyware infections.
Norton AntiSpam, the renamed spam filtering feature, has a set of spam rules, which cannot be viewed or edited. Whitelists and blacklists of senders can be created. Users may also create their own spam definitions. AntiSpam integrates with Outlook
Microsoft Outlook
Microsoft Outlook is a personal information manager from Microsoft, available both as a separate application as well as a part of the Microsoft Office suite...
, Outlook Express
Outlook Express
Outlook Express is an email and news client that is included with Internet Explorer versions 4.0 through 6.0. As such, it is also bundled with several versions of Microsoft Windows, from Windows 98 to Windows Server 2003, and is available for Windows 3.x, Windows NT 3.51, Windows 95 and Mac OS 9...
, and Eudora
Eudora (e-mail client)
Eudora is an e-mail client used on the Apple Macintosh and Microsoft Windows operating systems. It also supports several palmtop computing platforms, including Newton and the Palm OS....
, allowing users to tag e-mail as spam on-the-fly. E-mail identified as spam are either quarantined by default, however the feature can be configured to delete such messages automatically. In CNET
CNET
CNET is a tech media website that publishes news articles, blogs, and podcasts on technology and consumer electronics. Originally founded in 1994 by Halsey Minor and Shelby Bonnie, it was the flagship brand of CNET Networks and became a brand of CBS Interactive through CNET Networks' acquisition...
testing, AntiSpam correctly identified 94 percent of spam messages.
Product activation
Product activation
Product activation is a license validation procedure required by some proprietary computer software programs. In one form, product activation refers to a method invented by Ric Richardson and patented by Uniloc where a software application hashes hardware serial numbers and an ID number specific...
was introduced in this release. After installation, users are allowed a 15 day grace period to activate their copy of Norton Internet Security 2004. The program will not work after the deadline without the 24-character product key. The product key used to activate a copy of Norton Internet Security ties in with an alphanumeric
Alphanumeric
Alphanumeric is a combination of alphabetic and numeric characters, and is used to describe the collection of Latin letters and Arabic digits or a text constructed from this collection. There are either 36 or 62 alphanumeric characters. The alphanumeric character set consists of the numbers 0 to...
code based on a computer's hardware configuration. Users may activate their product five times with the same product key, however licensing terms dictate users are allowed only to install Norton Internet Security 2004 on one computer.
Version 2005
Symantec introduced Version 2005 on August 17, 2004. This version is sometimes referred to with the tagline of "AntiSpyware Edition", since spyware detection is integrated with Norton and is by default enabled. Found threats are listed, separating the ones already dealt with and the ones requiring user interaction. More detailed information is provided through a link to Symantec's website. However, PC ProPC Pro
PC Pro is one of several computer magazines published monthly in the United Kingdom by Dennis Publishing. PC Pro also licenses individual articles for republication in various countries around the world - and some articles are translated into local languages...
and PC Magazine noted lengthy scan times. A full scan took 24 minutes to over half an hour, respectively. IN PC Pro testing, Norton detected 61 percent of the spyware samples, compared to an average of 68 percent for all the tested products. Removal rates were above average, 72 percent verses the average of 68 percent. Norton blocked reinstallation with a score of 48 percent, compared to the group average of 43 percent. Overall, Norton ranked fifth among the tested products. In PC Magazine testing, Norton installed slowly on infected systems and failed to install on one altogether. Contacting Symantec did not resolve the issue.
Other new features include Internet Worm Protection to block worms, which scan IP addresses for open ports. It also blocks inbound ports based on known and suspected exploits using signatures and heuristics. The addition of the feature follows MSBlast in 2003 and Sasser
Sasser (computer worm)
Sasser is a computer worm that affects computers running vulnerable versions of the Microsoft operating systems Windows XP and Windows 2000. Sasser spreads by exploiting the system through a vulnerable network port...
in 2004, worms that exploited vulnerability
Vulnerability (computing)
In computer security, a vulnerability is a weakness which allows an attacker to reduce a system's information assurance.Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw...
in Microsoft Windows' operating systems. In response to emerging privacy threats — 75 percent of the threats in the last 12 months attempted to steal confidential information — this version adds phishing
Phishing
Phishing is a way of attempting to acquire information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popular social web sites, auction sites, online payment processors or IT...
protection. Using the firewall component, users can create a whitelist of sites where confidential information can be transmitted. Users are alerted when information is transmitted to a site not on the list. The Outbreak Alert feature warns users of major threats as classified by Symantec, and users can press the Fix Now button to applies a set of changes to close vulnerabilities, such as blocking necessary ports used by a propagating worm. The Browser Privacy can suppress information website generally receive about its visitors, such as the browser and operating system used. The feature can also block advertisements.
Privacy Control can warn users when sending confidential information. It can also be configured to block the transmission. It allows users to specify how the information can sent, such as via IM or e-mail. Item-specific exceptions allow users to control where there data can be sent. However, PC Pro found a flaw in the information filtering feature. The way information is formatted on the list of confidential information can affect its effectiveness. For example, entering the last six digits of a credit card number will not stop the numbers from leaking if they are grouped in four digits. PC Magazine also noted the fact anyone who can login to the computer can view the database of private information. For that reason, Symantec recommends entering only the last portion of sensitive information.
Norton AntiSpam now scans e-mails for spoofed URL
Spoofed URL
A Spoofed URL describes one website that poses as another. It sometimes applies a mechanism that exploits bugs in web browser technology, allowing a malicious computer attack. Such attacks are most effective against computers that lack recent security patches...
s and deals with any offending e-mail as spam. E-mails can also be blocked based on language, however by default the filter allows all languages. AntiSpam can sync its own list of allowed senders with POP3 address books. Users can train the spam filter by pointing out valid e-mail marked as spam and vice versa. Support for Yahoo! Mail
Yahoo! Mail
Yahoo! Mail is a web mail service provided by Yahoo!. It was inaugurated in 1997, and, according to comScore, Yahoo! Mail was the second largest web-based email service with 273.1 million users as of November 2010....
and Hotmail
Hotmail
Windows Live Hotmail, formerly known as MSN Hotmail and commonly referred to simply as Hotmail, is a free web-based email service operated by Microsoft as part of its Windows Live group. It was founded by Sabeer Bhatia and Jack Smith and launched in July 1996 as "HoTMaiL". It was one of the first...
was added in this release.
Version 2006 (13.0)
Norton SystemWorks
Norton SystemWorks is a discontinued system utility suite by Symantec. It expanded the tools found in Norton Utilities, and added other Symantec software titles, primarily anti-virus, and later backup software for the high-end versions.-Norton NT Tools:...
. An additional system tray icon is created by the Protection Center.
The installation was noted as lengthy by PC Magazine, especially on malware-infected systems. Spyware detection has been tweaked since the last release. It has been updated to better identify keyloggers. In PC Magazine testing, Norton successfully detected all 11 spyware threats and removed all but two. PC Magazine did give Norton credit even when manual removal was required. The suite also removed three of four commercial keyloggers. When attempting to install the spyware on a clean system, Norton blocked all 11 and two of the four commercial keyloggers. In most cases, it did not block the installation, however Norton did call for a scan after the spyware was installed. In PC Pro testing, Norton detected 78 percent of spyware, removed 82 percent, and blocked 65 percent from installing.
Norton AntiSpam was discontinued as a separate product from Symantec, now only available in Norton Internet Security. The feature can block all e-mail from unknown senders, and automatically blocks messages with suspicious elements such as invisible text, HTML forms, and phishing URLs. To improve accuracy, Norton analyzes outgoing e-mails and messages whose categorization is corrected by users by hitting the This is spam and This is not spam buttons. In PC Magazine testing, the feature marked one in ten valid e-mail as spam and let one in every six spam messages in the inbox. 400 messages were used, and the program was allowed to process the messages for over a week. In PC Pro testing, the feature performed better, blocking 96 percent of spam, with a false positive rate of 0.2 percent.
Norton recommends disabling the Windows Firewall
Windows Firewall
Windows Firewall is a software component of Microsoft Windows that provides firewalling and packet filtering functions. It was first included in Windows XP and Windows Server 2003...
to avoid redundant alerts. The firewall stealthed all significant ports in PC Magazine testing. Attacking the firewall itself was unsuccessful, PC Magazine was unable to stop its service
Windows Service
On Microsoft Windows operating systems, a Windows service is a long-running executable that performs specific functions and which is designed not to require user intervention. Windows services can be configured to start when the operating system is booted and run in the background as long as...
, terminate its process, or disable the firewall using simulated mouse clicks. The firewall also passed PC Pro's tests, successfully stealthing all ports.
Other features include Bloodhound technology, which looks for virus-like behavior to better find zero day virus
Zero day virus
A Zero day virus is a previously unknown computer virus or other malware for which specific antivirus software signatures are not yet available....
es. The Security Inspector looks for common vulnerabilities, including insecure user account passwords and browser insecurities. Advertisement blocking rewrites a website's HTML
HTML
HyperText Markup Language is the predominant markup language for web pages. HTML elements are the basic building-blocks of webpages....
to prevent advertisements from being displayed. Parental controls, an optional component, can block certain programs from accessing the Internet
Internet
The Internet is a global system of interconnected computer networks that use the standard Internet protocol suite to serve billions of users worldwide...
, such as IM clients, and restrict newsgroup access. Restrictions can be assigned to different Windows users accounts. Sites are classified in 31 categories, and the four profiles which can be assigned each block different categories of sites. Supervisors define exceptions, add global blocked sites, or block all access to sites not on a user-created whitelist. Both PC Magazine and PC Pro noted the exclusion of time-based restrictions. Information filtering can be controlled on a per-user basis.
Windows 98
Windows 98
Windows 98 is a graphical operating system by Microsoft. It is the second major release in the Windows 9x line of operating systems. It was released to manufacturing on 15 May 1998 and to retail on 25 June 1998. Windows 98 is the successor to Windows 95. Like its predecessor, it is a hybrid...
compatibility was dropped from this release.
Version 2007 (14.0)
The 2007 version was announced September 12, 2006. A tabbed interface allows users to access the Norton Protection Center and the program settings without separate tray icons and windowsWindow (computing)
In computing, a window is a visual area containing some kind of user interface. It usually has a rectangular shape that can overlap with the area of other windows...
open. Symantec revised Norton Internet Security and made this version more modularized, which has reduced the suite's memory usage to 10–15 megabytes and scan times by 30–35 percent. Another result is that spam filtering and parental controls are separate components to install. When installed, the features consume 100 MB of disk space.
Anti-phishing integrates with Internet Explorer
Internet Explorer
Windows Internet Explorer is a series of graphical web browsers developed by Microsoft and included as part of the Microsoft Windows line of operating systems, starting in 1995. It was first released as part of the add-on package Plus! for Windows 95 that year...
. It analyzes sites, examining the website's URL, title, form, page layout, visible text and links, and uses a blacklist to detect phishing sites. Users are blocked access from suspected phishing sites, however are presented an option to continue. In PC Magazine testing, the feature blocked 22 of 24 phishing sites, while Internet Explorer 7
Internet Explorer 7
Windows Internet Explorer 7 is a web browser released by Microsoft in October 2006. Internet Explorer 7 is part of a long line of versions of Internet Explorer and was the first major update to the browser in more than 5 years...
recognized 17 of the 24 sites. In PC Pro testing, the feature successfully blocked access to every phishing site it was tested against. Spam filtering no longer includes a language feature, Symantec claims it is less useful with current spam and created false positives. Tested against 1500 messages by PC Magazine, Norton let over half of the spam to the inbox. Five percent of valid mail were marked as spam. This version utilizes Symantec's Veritas
VERITAS Software
Veritas Software Corp. was an international software company that was founded in 1983 as Tolerant Systems, renamed Veritas Software Corp. in 1989, and merged with Symantec in 2005. It was headquartered in Mountain View, California...
VxMS technology to better identify rootkit
Rootkit
A rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications...
s. VxMS allows Norton to find inconsistencies among files within directories and files at the volume level. A startup application manager allows users to prevent applications from launching at login. This release drops support for Windows 2000 and was be compatible with Windows Vista upon its release with an update.
The firewall makes all decisions by itself to lessen the chance of being weakened by a misinformed decision. Applications known to be safe are allowed Internet access, and vice versa for malicious applications. Unknown ones are analyzed and blocked if they exhibit malicious behavior. In both PC Magazine and PC Pro testing, the firewall did not incorrectly block any safe applications from Internet access. All malware was blocked by the firewall. PC Magazine testing reflected the same results. The firewall also stealthed all ports. Exploits were blocked by the intrusion prevention system, which prevents threats from leveraging vulnerabilities. The system is updated whenever a vulnerability is identified for Windows-based computers. Attempts to disable the firewall were unsuccessful; registry changes, process termination, and simulated mouse clicks all failed. Disabling Windows services had no effect on the firewall since it works at the kernel driver level. This version automatically adjusts configuration for different networks based on the physical address
Physical address
In computing, a physical address, also real address, or binary address, is the memory address that is represented in the form of a binary number on the address bus circuitry in order to enable the data bus to access a particular storage cell of main memory.In a computer with virtual memory, the...
of the gateway rather than IP addresses.
In PC Magazine testing, Norton detected 15 of 16 spyware samples. 13 of the 16 were removed. Against eight commercial keyloggers, the suite removed all the samples. On a clean system, Norton blocked 14 of the 16 spyware samples from installing, and stopped seven of the eight keyloggers from installing.
Version 2008 (15.0)
The 2008 version was announced on August 28, 2007, adding support for Windows Vista 64-bit. New features include SONARSONAR (Symantec)
SONAR is the abbreviation for Symantec Online Network for Advanced Response. Unlike virus signatures, SONAR examines the behavior of applications to decide whether they are malicious...
, the Norton Identity Safe, and Browser Defender. SONAR monitors applications for malicious behavior. The Identity Safe supersedes the information filtering function; instead of blocking personal information from leaving the computer, it stores personal information to fill webforms. It is password protected and checks a website's authenticity before filling any forms. Browser Defender inspects and blocks suspicious API calls, intended to stop drive-by download
Drive-by download
Drive-by download means three things, each concerning the unintended download of computer software from the Internet:# Downloads which a person authorized but without understanding the consequences Drive-by download means three things, each concerning the unintended download of computer software...
s. The Network Map identifies networked computers with Norton Internet Security 2008 installed. Remote monitoring allows checking the status of other installations on different computers; problems are identified with a red "X" icon. Using the feature, users also can control network traffic between computers. It also warns users if they are using an unencrypted wireless network. The startup application manager and advertisement blocking features were dropped from this release. Information filtering, although superseded by the Identity Safe in the suite, is available separately. It can be used in conjunction with the Identity Safe.
Phishing protection now integrates with Mozilla Firefox
Mozilla Firefox
Mozilla Firefox is a free and open source web browser descended from the Mozilla Application Suite and managed by Mozilla Corporation. , Firefox is the second most widely used browser, with approximately 25% of worldwide usage share of web browsers...
. Testing by PC Magazine found that Norton blocked 94 percent of phishing sites, compared to 83 percent for Internet Explorer 7
Internet Explorer 7
Windows Internet Explorer 7 is a web browser released by Microsoft in October 2006. Internet Explorer 7 is part of a long line of versions of Internet Explorer and was the first major update to the browser in more than 5 years...
and 77 percent for Firefox 2
Mozilla Firefox 2
Mozilla Firefox 2 was a version of Firefox, a web browser released on October 24, 2006 by the Mozilla Corporation.Firefox 2 uses version 1.8 of the Gecko layout engine for displaying web pages...
. CNET identified an issue with the feature; when anti-phishing is disabled, the Identity Safe still offers users to automatically submit personal information to websites, including phishing sites. Symantec declined to call it a "flaw", stating it is recommended to use the Identity Safe with anti-phishing enabled. Alternatively, the Identity Safe could be used with Firefox and Internet Explorer's built-in anti-phishing capability.
PC Magazine found that the firewall put all ports in stealth mode. The firewall blocked ten of 12 leak tests, used to see if malware can evade the firewall's control of network traffic. Previous versions did not identify the tests because none carried a malicious payload. Another test was conducted using Core Impact, which successfully exploited one vulnerability on the test computer. However, other components of Norton stopped the exploit from causing harm. The other attempts were unsuccessful either because the system was invulnerable or Norton's Intrusion Prevention System stopped it. Attempts to disable the firewall were unsuccessful by PC Magazine. On the contrary, PC Pro identified 15 open ports on a computer with Norton installed.
In PC Magazine testing, Norton completely detected most of the malware samples. For two-thirds of the samples, all traces were removed. Norton found and removed all the commercial keyloggers. A full scan took nearly an hour to complete though, twice as long as the 2007 version. The suite blocked most of the malware from installing and all the commercial keyloggers, regardless of any modifications made to the samples. PC World noted that Norton removed 80 percent of malware-associated files and Registry
Windows registry
The Windows Registry is a hierarchical database that stores configuration settings and options on Microsoft Windows operating systems. It contains settings for low-level operating system components as well as the applications running on the platform: the kernel, device drivers, services, SAM, user...
entries.
Spam filtering imports users' address books to compile a whitelist of allowed senders. Addresses to which users send mail and e-mail tagged as valid mail can be automatically added to the whitelist. Using several thousand messages, PC Magazine found that Norton marked over 40 percent of valid e-mail as spam. Over 80 percent of valid newsletters were marked as spam. Norton did correctly identify 90 percent of spam e-mail.
Version 2009 (16.0)
A public beta was released July 14. A reduction in memory consumption was made, prompted by the fact 40 percent of people contacting Symantec support had 512 MB of RAM. The beta uses about 6 MB of memory, compared to 11 MB by the prior version. To reduce scan times, Norton Insight
Norton Insight
Norton Insight whitelists files based on reputation. Norton-branded antivirus software then leverage the data to skip known files during virus scans. Symantec claims quicker scans and more accurate detection with the use of the technology.-Development:...
uses data from Norton Community participants to avoid scanning files that are found on a statistically significant amount of computers. Citing a NPD Group
NPD Group
The NPD Group, Inc. is a leading North American market research company. The NPD Group consistently ranks among the top 25 market research companies in the independent Honomichl Top 50 report, which the media and the research industry acknowledge as a credible source of information on the market...
study finding that 39 percent of consumers switching antiviruses blamed performance, a CPU usage meter will be available within the final product to allow users to find the cause of high CPU usage, whether it be Norton or another program. This version features more frequent updates, a change called Norton Pulse Updates. Rather than deliver an update every eight hours, as the 2008 version does, Pulse Updates are delivered five to fifteen minutes. The Silent Mode automatically suspends alerts and updates when a program enters fullscreen mode and can be manually enabled. The suite's activities take place while the computer is idle, and terminate once user activity is registered. The final release (16.5) bundles spam filtering, which used to be a free download from Symantec. This release also bundles Norton Safe Web
Norton Safe Web
Norton Safe Web is a service developed by Symantec Corporation that is designed to help users identify malicious websites. Safe Web delivers information about websites based on automated analysis and user feedback....
, which identifies malicious websites, compatible with Internet Explorer and Firefox. Norton Safe Web
Norton Safe Web
Norton Safe Web is a service developed by Symantec Corporation that is designed to help users identify malicious websites. Safe Web delivers information about websites based on automated analysis and user feedback....
color codes search results from famous search engine such from Google
Google
Google Inc. is an American multinational public corporation invested in Internet search, cloud computing, and advertising technologies. Google hosts and develops a number of Internet-based services and products, and generates profit primarily from advertising through its AdWords program...
and Yahoo for safety. The Norton Safe Web
Norton Safe Web
Norton Safe Web is a service developed by Symantec Corporation that is designed to help users identify malicious websites. Safe Web delivers information about websites based on automated analysis and user feedback....
toolbar also includes an Ask.com search box. The search box does not share code with the Ask toolbar; instead the box redirects queries to the Ask search engine. Norton Safe Web is compatible with Internet Explorer and Firefox. Norton Safe Web.
Benchmarking
Benchmark (computing)
In computing, a benchmark is the act of running a computer program, a set of programs, or other operations, in order to assess the relative performance of an object, normally by running a number of standard tests and trials against it...
conducted by PassMark Software highlights the 2009 version's 52 second install time, 32 second scan time, and 7 MB memory utilization. Symantec funded the benchmark test and provided scripts used to benchmark each participating antivirus software
Antivirus software
Antivirus or anti-virus software is used to prevent, detect, and remove malware, including but not limited to computer viruses, computer worm, trojan horses, spyware and adware...
. Tests were conducted in Windows Vista running on a dual core processor. PC Magazine found the suite added 15 seconds to the boot time, with a baseline of 60 seconds. Norton added less than 5 percent to the time it takes to complete file operations. 25 percent more time was taken to unzip and zip a set of files.
In PC Magazine testing, Norton removed most traces of 40 percent of the malware. On a similar test, specifically using commercial keyloggers, Norton was able to remove most of the keyloggers, beating other tested products. Norton blocked all attempts to install malware on a clean system. Modifications made to the samples did not fool Norton. Norton was not able to block the installation of all the commercial keyloggers.
Phishing protection blocked 90 percent of verified phishing websites in PC Magazine testing. Internet Explorer 7 caught 75 percent, and Firefox caught 60 percent.
Norton stealthed all ports, according to PC Magazine. Port scans were unsuccessful. The firewall blocked all exploit attempts by Core Impact.
Malware blocking and removal garnered good results PC Magazine testing. All but one malware samples contained within a folder were removed once the folder was opened. The last one was removed when executed. Modifications made to the samples did not affect detection. On a similar test, specifically using commercial keyloggers, Norton did not successfully detect all. In removing threats, Norton almost completely removed 40 percent of the malware samples and related executables. Norton was also able to remove more commercial keyloggers than any other product.
Version 2010 (17.0)
Version 2010 was released officially on September 8, 2009. This version features a technology code named, Project Quorum, which introduces reputation-based threat detection to keep up with the 200 million attacks each month, many of which Symantec claims evade signature based detection. The new approach relies on Norton Community Watch, in which participants send information about the applications running on their computers. Safe applications exhibit common attributes, such as being of a known origin with known publishers. Conversely, new malware may have an unknown publisher, among other attributes. Using the data a "reputation score" is calculated and can be used to infer the likelihood of an unknown application being safe, or malicious.Other facets of Quorum are parental controls and spam filtering. Norton Internet Security 2010 bundles a free subscription of OnlineFamily.Norton
OnlineFamily.Norton
OnlineFamily.Norton is a cloud-based parental control service. Online Family is aimed at "fostering communication" involving parents and their children's online activities...
, which PC Magazine found to be an improvement over the parental controls bundled with prior releases. Spam filtering uses technologies Symantec acquired from Brightmail
Brightmail
Brightmail is an e-mail filtering company in the United States. It was acquired by Symantec on May 19, 2004 for $370 million in cash. The company was founded in 1998 and raised $55M in three rounds of venture capital led by Accel, TCV, and Symantec. The CEO at the time of acquisition was Enrique...
. Two filters are used to find spam: a locally installed one and a check against Symantec's servers to see if the message is known spam. In PC Magazine
PC Magazine
PC Magazine is a computer magazine published by Ziff Davis Publishing Holdings Inc. A print edition was published from 1982 to January 2009...
testing, no valid e-mail were marked as spam. However, 11 percent of spam still made it to the inbox. This was a significant improvement over prior releases. Another improvement to the product is the improved heuristic feature called SONAR 2. It leverages reputation data to judge if a program is malicious or clean. Norton Insight has also been expanded, showing users the number of Norton Community participants who have a certain program installed, its impact of system resources, and how long it has been released. Information about the program's origin and a graph of its resource usage is also provided. A new feature codenamed Autospy helps users understand what Norton did when malware was found. The malware's actions and Norton's resolution are presented to the user. Previous releases removed threats on sight and quietly warned users, potentially confusing when users are deceived in downloading rogue security software.
Another addition to the product is the new "Flip Screen". With a compatible graphics card, the main display "flips over" to show the opposite side of the main interface, consisting of a chart of CPU or memory usage and a timeline of security events. Without one, the "Flip Screen" link is replaced by a "back" link, which opens the back of the windows as a separate window.
The product also adds a search engine labeled "Safe Search". The custom search allows the user to filter out unsafe sites, get insight on them, and keep track of cookies.
Malware removal and blocking performed well, setting or meeting records in PC Magazine testing. It achieved a detection rate of 98%. The highest out of 12 tested antivirus products. The exception was blocking commercial keyloggers, where Norton made an above average score. File operations took 2 percent longer, and the file compression and extraction test took 4 percent longer. The only area where Norton introduced a significant delay was when the system was booting, the beta version of the suite added 31 percent to the boot time, significantly longer than prior versions. According to the Norton performance comparison website, Norton Internet Security scans 31 percent faster, is 70 percent lighter, and installs 76 percent faster than the leading Anti-virus product. According to av-comparatives, http://www.av-comparatives.org Norton Internet Security was "Best Product of 2009", Bronze award for 98.6% detection rate in 2010 and Norton Internet Security 2010 blocked 99/100 internet threats from infecting the user's computer.
Version 2011 (18.0)
Norton Internet Security 2011 was released for Beta testing on April 21, 2010. Changes include a new user interface and improved scanning of internet sites for malware. With the 2011 version, SymantecSymantec
Symantec Corporation is the largest maker of security software for computers. The company is headquartered in Mountain View, California, and is a Fortune 500 company and a member of the S&P 500 stock market index.-History:...
also released an application that "scans" the user's Facebook
Facebook
Facebook is a social networking service and website launched in February 2004, operated and privately owned by Facebook, Inc. , Facebook has more than 800 million active users. Users must register before using the site, after which they may create a personal profile, add other users as...
feed for any malware links. This application does not require a valid subscription. In a test sponsored by Symantec, Norton Internet Security 2011 was the only security suite to ever achieve a 100 percent protection score in a new third-party test from Dennis Labs. Improved reputation scan provides the user with an easy to understand interface on files stored on the user's computer. Marking them as trusted, good, poor, or bad. The final version of Norton Internet Security 2011 was released on August 31, 2010. New features in version 2011 also include Norton Rescue Tools. These tools include Norton Bootable Recovery tool and Norton Power Eraser.
On December 9, 2010, Symantec released the 18.5 version through Norton LiveUpdate
Norton LiveUpdate
Norton LiveUpdate is an application developed by Symantec Corporation that downloads and installs security updates and software patches. LiveUpdate can only apply updates for a particular version of Norton; it cannot however upgrade a version of Norton to a later version...
. However, this update was later pulled due to numerous reports on the Norton forums that the update is causing system instability and freeze ups during system scans (both full and quick scans). This issue only affect some customers. Users affected by this update are advised to uninstall the product, run the Norton Removal Tool, and reinstall the 18.1 version from http://www.norton.com/nis11. Norton later fixed the bugs and re-released the update.
The new product features a new Norton logo which uses the VeriSign checkmark formerly seen in VeriSign's own logo, as well as several new icon changes to the Norton Safe Web
Norton Safe Web
Norton Safe Web is a service developed by Symantec Corporation that is designed to help users identify malicious websites. Safe Web delivers information about websites based on automated analysis and user feedback....
and Norton Identity Safe features.
Version 2012 (19.0)
Released on September 6, 2011, Norton Internet Security 2012 brought new features. One of the new features that was included with the new program is Download InsightNorton Download Insight
Norton Download Insight provides the reputation information of any executable file that you download using the Internet Explorer 6 or Firefox 3.0 browsers or later. Download Insight supports only downloads using hypertext transfer protocol...
2.0, which not only monitor files for safety but also the stability of a given file. That means that If a file is stable on Windows 7, but unstable on Windows XP, XP users will be notified for the instability of the file.
Also, integration with specialised removal tools is added, for better cleanup of already infected systems. A new smaller and more effective version of Norton power eraser is launched to assist in removal of fake antivirus software and other deeply-embedded threats that are otherwise hard to remove. A new tool called Norton Management helps manage different computers and devices equipped with Norton software from a single location.
Another feature added with this release is Sonar 4
SONAR (Symantec)
SONAR is the abbreviation for Symantec Online Network for Advanced Response. Unlike virus signatures, SONAR examines the behavior of applications to decide whether they are malicious...
. Another welcome change is that identity Safe and Safe Web
Norton Safe Web
Norton Safe Web is a service developed by Symantec Corporation that is designed to help users identify malicious websites. Safe Web delivers information about websites based on automated analysis and user feedback....
are finally compatible with Google Chrome
Google Chrome
Google Chrome is a web browser developed by Google that uses the WebKit layout engine. It was first released as a beta version for Microsoft Windows on September 2, 2008, and the public stable release was on December 11, 2008. The name is derived from the graphical user interface frame, or...
and all the passwords and notes can be stored in the cloud should the user wish.
The user interface is also simplified with only 3 buttons. The 3rd button opens a more advanced and complicated UI, where the user is able to manage settings and access different product features. The CPU meter, a long-time supported and loved feature, that was removed from Norton 2011, also makes a return (only on the "advanced screen").
Combining the netbook and desktop line, Norton Internet Security integrates Bandwidth metering, which controls product's traffic usage and takes it down to minimum if necessary. This is ideal for networks with limited traffic. Also, the user interface window adjust accordingly to the size of the computer screen.
This version of Norton Internet Security includes several easter eggs. Pressing Shift+1, 2, 3 or 4 would change the theme to default background (plain black), ray, animals, and floral respectively. Also holding CTRL + WinKey + Alt while pressing "performance buton
Norton System Insight
- Overview :The Norton System Insight is part of Performance monitoring system, found in Norton 2010-2012 lines. It monitors and displays information about downloaded files, installed applications, scans and detected security risks. It also shows the number of Performance alerts...
" to activate "Crazy Flip", which will make the window flip head over heels. The effect would continue until the main window is closed and reopened.
In addition, scans are no-longer scheduled through the Windows Task Scheduler
Task Scheduler
Task Scheduler is a component of Microsoft Windows that provides the ability to schedule the launch of programs or scripts at pre-defined times or after specified time intervals. It was first introduced in the Windows 95 Plus! pack as System Agent but was renamed to Task Scheduler in Windows 98...
, but through the Symantec's more advanced one, which waits for the user to stop using the keyboard and mouse (e.g. leaves the PC) and then performs tasks.
Netbook Edition
SymantecSymantec
Symantec Corporation is the largest maker of security software for computers. The company is headquartered in Mountain View, California, and is a Fortune 500 company and a member of the S&P 500 stock market index.-History:...
has released a special edition of Norton Internet Security optimized for Netbooks. This is available as download from the Symantec website or in a USB thumb drive.
Differences from the "regular" version
Symantec states that the Netbook edition is optimized for netbooks. The main display is optimized to provide support for the 800 x 480 screen resolution. In addition, non-critical tasks are delayed while the netbook is on battery. Furthermore, the Netbook edition contains complimentary access to Norton's secure online backup and parental control to protect children as they surf the web.Media
Norton Internet Security is available on Symantec's Website as a download or users can opt for a physical CD version for a higher price. The primary distribution media sold in stores is a Compact Disk (CD). In addition, many stores carry the netbookNetbook
Netbooks are a category of small, lightweight, legacy-free, and inexpensive laptop computers.At their inception in late 2007 as smaller notebooks optimized for low weight and low cost — netbooks omitted certain features , featured smaller screens and keyboards, and offered reduced computing...
version of Norton Internet Security, which is distributed on a thumb drive. This special Netbook edition is also available as a download from the Symantec
Symantec
Symantec Corporation is the largest maker of security software for computers. The company is headquartered in Mountain View, California, and is a Fortune 500 company and a member of the S&P 500 stock market index.-History:...
website.
Version 1.0 through 3.0
Norton Internet Security version 1.0 for Mac was released November 1, 2000. It can identify and remove both Windows and Mac virusesComputer virus
A computer virus is a computer program that can replicate itself and spread from one computer to another. The term "virus" is also commonly but erroneously used to refer to other types of malware, including but not limited to adware and spyware programs that do not have the reproductive ability...
. Other features include a firewall, advertisement blocking in the browser
Web browser
A web browser is a software application for retrieving, presenting, and traversing information resources on the World Wide Web. An information resource is identified by a Uniform Resource Identifier and may be a web page, image, video, or other piece of content...
, parental controls, and the ability to prevent confidential information from being transmitted outside the computer. Users are prompted before such information is able to be transmitted. The incorporation of Aladdin Systems'
Allume Systems
Allume Systems was a software developer, originally founded in 1988 by David Schargel and Jonathan Kahn in New York City as Aladdin Systems to develop, publish and distribute software for personal computers. Allume was incorporated in January 1989...
iClean allows users to purge the browser cache, cookies
HTTP cookie
A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site...
, and browsing history within Norton's interface. Operating system requirements call for Mac OS 8.1. Hardware requirements call for 24 MB of RAM, 12 MB of disk space, and a PowerPC
PowerPC
PowerPC is a RISC architecture created by the 1991 Apple–IBM–Motorola alliance, known as AIM...
processor.
Version 2.0 also ties in with the WHOIS
WHOIS
WHOIS is a query and response protocol that is widely used for querying databases that store the registered users or assignees of an Internet resource, such as a domain name, an IP address block, or an autonomous system, but is also used for a wider range of other information. The protocol stores...
database, allowing users to trace attacking computers. Users can inform network administrators of the attacking computers for corrective actions. When running under Mac OS 8.1 or 9
Mac OS 9
Mac OS 9 is the final major release of Apple's Mac OS before the launch of Mac OS X. Introduced on October 23, 1999, Apple positioned it as "The Best Internet Operating System Ever," highlighting Sherlock 2's Internet search capabilities, integration with Apple's free online services known as...
, a PowerPC processor, 24 MB of RAM, and 25 MB of free space is required. Under Mac OS X 10.1, a PowerPC G3
PowerPC G3
The PowerPC 7xx is a family of third generation 32-bit PowerPC microprocessors designed and manufactured by IBM and Motorola . This family is called the PowerPC G3 by its well-known customer Apple Computer...
processor, 128 MB of RAM, and 25 MB of free space is required.
The subsequent release, version 3.0, maintained the feature set found in version 2.0. The firewall now allocates internet access as needed rather than relying on user input using predefined rules. Compatibility with OS 8 was dropped. When running under OS 9.2, a PowerPC processor, 24 MB of RAM, and 25 MB of free space is required. Under OS X 10.1.5 through 10.3, a PowerPC G3, 128 MB of RAM, and 150 MB of free space is required. However, version 3.0 is not compatible with OS X 10.4
Mac OS X v10.4
Mac OS X v10.4 Tiger is the fifth major release of Mac OS X, Apple's desktop and server operating system for Macintosh computers. Tiger was released to the public on 29 April 2005 for US$129.95 as the successor to Mac OS X Panther , which had been released 18 months earlier...
, or "Tiger".
Version 4.0
Version 4.0 was released on December 18, 2008. Symantec also markets a bundle of Version 4.0 and the 2009 version for Windows, intended for users with both Microsoft Windows and Mac OS X installed. iClean was dropped from this release. The firewall now blocks access to malicious sites using a blacklist updated by Symantec. To prevent attackers from leveraging insecurities in the Mac or installed software, exploit protection was introduced in this release. Phishing protection was introduced in this release as well. Operating system requirements call for Mac OS X 10.4.11 or higher. A PowerPC or Intel CoreIntel Core
Yonah was the code name for Intel's first generation of 65 nm process mobile microprocessors, based on the Banias/Dothan-core Pentium M microarchitecture. SIMD performance has been improved through the addition of SSE3 instructions and improvements to SSE and SSE2 implementations, while integer...
processor, 256 MB of RAM and 150 MB of free space are required.
Performance and protection capabilites
From 2009 to 2012 series, Symantec makes a huge change in product's speed and performance. Norton products now have only 2 running processes, using about 15 mb of RAM.According to PassMark Security Benchmark 2012 Norton AntiVirus and Norton Internet Security are the lightest suites available. Av-comparatives.org also tested these products and give similar results.
PCMag recognises 2011 and 2012 lines as the fastest and strongest in protection.
PCWorld's tests of security software put Norton Internet Security 2009 on the 1-st place.
In 2011's test of PCWorld Norton Internet Security was the winner. Av-test.org certifies Norton, putting it on a second place after BitDefender. Many other reputable sources like Dennis Technology Labs confirm the performance and effectivness of Norton 2011 and 2012 lines.
FBI cooperation
Symantec, in compliance with the Federal Bureau of InvestigationFederal Bureau of Investigation
The Federal Bureau of Investigation is an agency of the United States Department of Justice that serves as both a federal criminal investigative body and an internal intelligence agency . The FBI has investigative jurisdiction over violations of more than 200 categories of federal crime...
(FBI), whitelisted Magic Lantern
Magic Lantern (software)
Magic Lantern is keystroke logging software developed by the United States' Federal Bureau of Investigation. Magic Lantern was first reported in a column by Bob Sullivan of MSNBC on 20 November 2001 and by Ted Bridis of the Associated Press.-How it works:...
, a keylogger
Keystroke logging
Keystroke logging is the action of tracking the keys struck on a keyboard, typically in a covert manner so that the person using the keyboard is unaware that their actions are being monitored...
actively developed by the FBI. The purpose of Magic Lantern is to obtain passwords to encrypted e-mail as part of a criminal investigation. Magic Lantern was first reported in the media by Bob Sullivan
Bob Sullivan (journalist)
Bob Sullivan is an award winning American online journalist, author and one of the founding members of msnbc.com...
of MSNBC
MSNBC
MSNBC is a cable news channel based in the United States available in the US, Germany , South Africa, the Middle East and Canada...
on November 20, 2001 and by Ted Bridis of the Associated Press
Associated Press
The Associated Press is an American news agency. The AP is a cooperative owned by its contributing newspapers, radio and television stations in the United States, which both contribute stories to the AP and use material written by its staff journalists...
. Magic Lantern is deployed as an e-mail attachment
E-mail attachment
An email attachment is a computer file sent along with an email message. One or more files can be attached to any email message, and be sent along with it to the recipient. This is typically used as a simple method to share documents and images...
. When the attachment is opened, a trojan horse
Trojan horse (computing)
A Trojan horse, or Trojan, is software that appears to perform a desirable function for the user prior to run or install, but steals information or harms the system. The term is derived from the Trojan Horse story in Greek mythology.-Malware:A destructive program that masquerades as a benign...
is installed on the suspect's computer. The Trojan horse is activated when the suspect uses PGP
Pretty Good Privacy
Pretty Good Privacy is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting and decrypting texts, E-mails, files, directories and whole disk partitions to increase the security...
encryption, often used to increase the security of sent e-mail messages. When activated, the trojan horse will log the PGP password, which allows the FBI to decrypt user communications. Symantec and other major antivirus vendors have whitelisted Magic Lantern, rendering their antivirus products, including Norton Internet Security, incapable of detecting Magic Lantern. Concerns include uncertainties about Magic Lantern's full potential and whether hackers could subvert it for purposes outside the jurisdiction of the law.
Graham Cluley, a technology consultant from Sophos
Sophos
Sophos is a developer and vendor of security software and hardware, including anti-virus, anti-spyware, anti-spam, network access control, encryption software and data loss prevention for desktops, servers, email systems and other network gateways....
, said "We have no way of knowing if it was written by the FBI, and even if we did, we wouldn’t know whether it was being used by the FBI or if it had been commandeered by a third party". Another reaction came from Marc Maiffret, chief technical officer
Chief technical officer
A chief technology officer is an executive-level position in a company or other entity whose occupant is focused on scientific and technological issues within an organization....
and cofounder of eEye Digital Security, "Our customers are paying us for a service, to protect them from all forms of malicious code. It is not up to us to do law enforcement's job for them so we do not, and will not, make any exceptions for law enforcement malware or other tools."
FBI spokesman Paul Bresson, in response if Magic Lantern needed a court order to deploy, "Like all technology projects or tools deployed by the FBI it would be used pursuant to the appropriate legal process."
Proponents of Magic Lantern argue the technology would allow law enforcement to efficiently and quickly decrypt messages protected by encryption schemes. Implementing Magic Lantern does not require physical access to a suspect's computer, unlike Carnivore, a predecessor to Magic Lantern, since physical access to a computer would require a court order.
Uninstallation
Older versions of Norton were hard and slow to uninstall, leaving many traces and sometimes completing with errors. However in the 2009 versions, Symantec featured their own uninstaller, that removes their products better and more quickly, usually in less than a minute. Norton Removal Tool is a well known instrument that removes Norton products completely, without any trace. The tool can be downloaded from Symantec's websiteSymantec reports that Norton 2010 range of products feature a cleaner uninstall and over-installs is the recommended update route to 2011.
Windows Service Packs
When Norton Internet Security 2008 is installed, users may encounter incompatibilities upgrading to Windows XP Service Pack 3 or Windows Vista Service Pack 1. Users report numerous invalid registryWindows registry
The Windows Registry is a hierarchical database that stores configuration settings and options on Microsoft Windows operating systems. It contains settings for low-level operating system components as well as the applications running on the platform: the kernel, device drivers, services, SAM, user...
keys being added by a tool named fixcss.exe, resulting in an empty Device Manager and missing devices such as wireless network adapters. Symantec initially blamed Microsoft for the incompatibilities but has since accepted partial responsibility.
Dave Cole, Symantec's senior director of product management, acknowledged that users running Norton products were experiencing problems, but said the numbers are small. Cole also said that Symantec had done "extensive testing" of its products with Windows XP SP3, but this issue was not encountered. Cole blamed Microsoft "This is related to XP SP3." Microsoft recommended that users contact Windows customer support. To resolve the problem, Symantec has issued a fix intended for users before upgrading. Symantec also recommends disabling the tamper protection component in the 2008 release, dubbed SymProtect. A tool to remove the added registry entries is also available from Symantec.
Windows Vista
Sarah Hicks, Symantec's vice president of consumer product management, voiced concern over Windows Vista 64-bit's PatchGuardKernel Patch Protection
Kernel Patch Protection , informally known as PatchGuard, is a feature of 64-bit editions of Microsoft Windows that prevents patching the kernel...
feature. PatchGuard was designed by Microsoft to ensure the integrity of the kernel
Kernel (computing)
In computing, the kernel is the main component of most computer operating systems; it is a bridge between applications and the actual data processing done at the hardware level. The kernel's responsibilities include managing the system's resources...
, a part of a operating system
Operating system
An operating system is a set of programs that manage computer hardware resources and provide common services for application software. The operating system is the most important type of system software in a computer system...
which interacts with the hardware. Rootkit
Rootkit
A rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications...
s often hide in a operating system's kernel, complicating removal. Mike Dalton, European president of McAfee
McAfee
McAfee, Inc. is a computer security company headquartered in Santa Clara, California, USA. It markets software and services to home users, businesses and the public sector. On August 19, 2010, electronics company Intel agreed to purchase McAfee for $7.68 billion...
said, "The decision to build a wall around the kernel with the assumption it can't be breached is ridiculous", claiming Microsoft was preventing security vendors from effectively protecting the kernel while promoting its own security product, Windows Live OneCare
Windows Live OneCare
Windows Live OneCare was a computer security and performance enhancement service developed by Microsoft for Microsoft Windows. A core technology of OneCare was the multi-platform RAV , which Microsoft purchased from GeCAD Software Srl in 2003, but subsequently discontinued...
. Hicks said Symantec did not mind the competition from OneCare. Symantec later published a white paper detailing PatchGuard with instructions to obtain a PatchGuard exploit. After negotiations and investigations from antitrust regulators, Microsoft decided to allow security vendors access to the kernel by creating special API
Application programming interface
An application programming interface is a source code based specification intended to be used as an interface by software components to communicate with each other...
instructions.
Windows 7 compatibility
Versions 2009, 2010, 2011 and 2012 are compatible with Windows 7. Version 2006 to 2008 users can receive an upgrade to the latest version (Norton Internet Security 2010) through the Norton Update Center. Version 2009 will receive a patch automatically through the built in LiveUpdate feature. However, this patch will have to be installed before the upgrade. However, Version 2010 is supported right out of the box. Thus, those upgrading from Windows VistaWindows Vista
Windows Vista is an operating system released in several variations developed by Microsoft for use on personal computers, including home and business desktops, laptops, tablet PCs, and media center PCs...
will have to get the 2010 or later version. Versions 2005 and older are not eligible for the upgrade or a patch.