Norton AntiVirus 2012

CNET Editors' review

by: Seth Rosenblatt on September 15, 2011

The bottom line: Low-impact performance, strong security, and useful features are the hallmarks of Norton AntiVirus 2012, one of the best antivirus suites available.

Review:
Editors' note: Portions of this review are based on CNET's review of Norton Internet Security 2012.

Over the past few years, Symantec has completed a course reversal for its Norton consumer Internet security suites. The massive package of security tools works better than it ever has before, with an impressive set of features, some useful new tools including remote management and download stability analysis, and third-party security efficacy benchmarks that are at the top of the heap. Meanwhile, CNET Labs' performance benchmarks indicate that though Norton doesn't leave the smallest footprint on your system, users should see a minimal impact overall.

Installation
For the third year in a row, Norton's formerly sluggish beast offers a smooth and fast installation operation. Once you run the installer, the program is ready to operate in about a minute--impressively fast, and doubly so considering past performance. The installation process is also the first time that you will interact with Quorum, Norton's behavior-based detection engine. You'll be asked to participate by sending anonymous data to Symantec's cloud. Opting out of the data submission, according to Symantec, will not affect your security.

Running the trial of Norton also requires registering the program. Like many programs, Norton used to force open your default browser and take you to the company's registration Web site. Now you can register from within the program. Uninstalling the software left about 10 Registry entries behind, but no other traces were detectable. Overall, Norton's installation experience was fast and hassle-free, with a minimum of configuration options--but the ones that did come up appeared necessary.

Interface
Norton AntiVirus 2012 contains some changes to the 2011 interface, although the design is heavily reminiscent of the previous version. It keeps the dark theme, punctuated by yellow text, and the contrast works well. Changes this year include a reorganized and streamlined Settings interface; a "pinnable" Advanced screen--so that power users can get about their business faster--which also comes with a CPU gauge; and tweaks to the System Status indicator. This year, the interface feels more balanced between the feature display and empty space.

The simplified layout offers Scans on the left, Updates in the center, and Advanced tools on the right. Clicking on one reveals controls specific to that area of protection. At the bottom of the interface is a wide, short map of the world covered with blinking yellow dots. Each one, according to Symantec, represents a threat to one of its users that has been successfully blocked. The Activity Map visual is cute, but completely irrelevant to your personal safety. More interesting is that below the map there are a series of mobile app-style buttons. In NIS you can access the new Norton Management, Norton Mobile, Norton Online Family, Norton Safe Web, and Norton Backup without having to jump to your browser. NAV only has the Activity Map and Norton Backup.

Features and support
There aren't many new features in Norton AntiVirus 2012, but what's new ought to appeal to the kind of person who wants the souped-up security in this robust suite.

One of the better new features is a change to Download Insight. This community-driven tool originally evaluated files being downloaded for security, but now it looks at their stability for other Norton users, too. There are also metered bandwidth options for people on rate-limited connections, and several interface tweaks to make the program easier on the eyes and to make it easier to find things.

The reputation-based security checks where your programs were installed from and when they were installed, and compares that against data from the 58 million users participating in the crowd-sourced Norton Community Watch to see if any of your programs should be red-flagged. Norton's System Insight component has been bumped up to version 2.0; System Insight is the proprietary internal network that warns you when your programs unnecessarily hog system resources. This gives some extra heft to the system performance map, where you can click on any spike and see what caused it.

The third iteration of Download Insight applies the same reputation-based logic to new downloads, and the fourth version of Norton SONAR (Symantec Online Network for Automatic Response) looks for suspicious software behavior and automatically chooses protective actions. You can toggle how aggressive SONAR is in the Settings window.

Along with the quick scan, the full-system scan, and the custom scan for viruses and malware, you can now have Norton scan your Facebook wall for malicious links. There are also on-demand reputation-based quick scans, full scans, and custom scans for users who want Norton to immediately scan their installed programs. After completing a scan, Norton provides users with a summary report. More-detailed information, including scan duration and a deeper dive into threats discovered, can be read under the History option from the main window. There's also a link that you can follow in case you believe that Norton missed something in its scan, although as reputation-based protection matures, on-demand scanning becomes less of an issue when compared with the "always-on" protection offered here.

The bootable recovery tool isn't new, but it now comes with a feature that automatically creates a CD, DVD, or USB-based bootable device. The USB component is especially important on optical-drive-free systems such as Netbooks.

As with the rest of the program, the support options have been streamlined behind a drop-down menu in the top right of the interface. Help opens local support, Tutorials leads to a Web site with extensive how-tos, and the Get Support link accesses the breadth of Norton's customer support in a new window. Here, users can chat with tech support 24-7, explore the user manual, and check out the Norton FAQ and knowledge base. Phone support is also available, although Symantec takes part in the trend to make phone support harder to access by funneling users to online resources.

Performance
Norton's fast installation and comprehensive feature set would be useless without solid performance, and Norton Internet Security 2012 delivers extremely high third-party efficacy benchmarks and strong performance benchmarks.

In a real-world test, Norton 2012 completed a Quick Scan in 2 minutes, 43 seconds; the Full Scan took 1 hour 43 minutes and 54 seconds. While the Full Scan average is comparable to last year's, the Quick Scan was approximately 1 minute and 30 seconds slower than last year's average.

CNET Labs' benchmarks found both Norton Internet Security 2012 and Norton AntiVirus 2012 to have performed well, although not as strongly as some of their competitors. Note that we can't directly compare this year's results with last year's because we upgraded our testing computer from Windows 7 x64 to Windows 7 x64 with Service Pack 1.

NIS 2012 slowed down the Labs' computer boot time by about 11.8 seconds, one of the fastest scores this year, whereas NAV 2012 added an unimpressive 21.2 seconds. This is in line with previous years, which saw NIS do better on boot than NAV.

Both had a very small impact on the computer's shutdown time, slowing it down only by about 4 seconds compared with an unprotected computer. Scan times for both were disappointingly average in the Labs; in previous years, they were aggressively competitive. However, our in-use system performance tests, the iTunes decoding, Microsoft Office, media multitasking, and Cinebench tests, showed both Norton suites having a low-level impact on our test computer. This means that, all things being equal, you're not going to notice much when Norton is running as you go about your computing business.

*All tests measured in seconds, except for Cinebench. On the Cinebench test, the higher number is better.

In independent threat detection and removal tests, Norton is a top performer. In the AV-Test.org test on Windows 7 from the first quarter of 2011, Norton Internet Security 2011 scored 15 out of 18 overall, one of the better suites tested. The suite had a 5.5 rating out of 6 in Protection, a 5.0 in Repair, and a 4.5 in Usability.

The second-quarter 2011 test, on a Windows XP computer, definitely showed improvement in some areas and regression in others. It scored 13.5 out of 18 overall, a solid midrange score. The suite improved in Protection and Repair with a 5.0 rating out of 6 for both, but Usability dropped to 3.5 most likely due to false positives.

Third-quarter results aren't in yet, but results shared by AV-Test.org with CNET indicate that the suite continues to perform well. It notched a 98.94 percent malware detection rate, higher than the overall average rate of 97.31 percent in August 2011 certification testing, but not as high as some competitors, such as Bitdefender. The suite was able to remove 83.3 percent of active malware infections, only slightly higher than the industry average of 80 percent. In AV-Test.org's zero-day attacks test, Bitdefender blocked 100 percent of the attacks, compared with the average August 2011 certification results of 92.16 percent. The suite also did not find any false positives.

The most recent AV-Comparatives.org Whole Product test, which looks at on-demand scanning, retroactive tests, and "real-world" guards including cloud-based protections, puts Norton Internet Security 2011 toward the front of the class, out of 17 suites tested. Looking at Whole Product test results cumulatively from January 2011 to June 2011 found that AVG came in 13th, blocking 99.1 percent of threats.

Dennis Technology Labs, a member of the Anti-Malware Testing Standards Organization (AMTSO), found in January 2011 that Norton Internet Security 2011 earned an overall protection score of 142 (PDF), tied with Trend Micro. Norton also had zero false-positive warnings during the test.

Following the path blazed by Norton 2009 through 2011, Norton continues to build a strong performance record based on excellent detection, fast scan times, and low false positives. However, it's clear that according to some tests, there's been some small slippage.

Conclusion
Norton AntiVirus 2012 contains only core security features. All the useful extras you'll have to upgrade to Norton Internet Security to get. In that respect, NAV is much too similar to the free security suites out there, and unless support or the slightly better protection is a major priority for you, we recommend one of those instead.