DDLhere

ondemandemails

F-SECURE INTERNET SECURITY 2008

FSIS takes a two-tier approach to configuration. Most users will just look at the straightforward status
information available on the main screen and make simple, high-level configuration choices. For example,
the firewall offers these choices: Block All, Office, Strict, Normal, Custom, and Allow All. Under the hood, each of
these choices sets a variety of more specific options. If you're technically inclined, you can choose the Custom level,
click a link for Advanced settings, and do all the fine-tuning you want. It's a good balance—not too scary for Granny,
but adjustable if the need arises.

Strong Silent Spyware Smasher

I rely on the independent antivirus testing labs to report on the efficacy of antivirus programs. I look for certification
from ICSA Labs and West Coast Labs for both detection and removal and for a VB100% award from Virus Bulletin—some have
other certifications. But I had a little trouble getting the necessary info for this product.

F-Secure's 2007 suite got both Checkmarks from West Coast Labs, but the 2008 product hasn't been through testing yet.
Strangely, the 2007 certifications have vanished from the West Coast Labs site. The antivirus has received the VB100%
award from Virus Bulletin for many years in a row. In the most recent test, however, the F-Secure scanning engine
missed one sample and hence missed the VB100% award. Turns out they shipped an old virus database, and Virus Bulletin
uses non-connected PCs for testing, so it couldn't update. Virus Bulletin verified that F-Secure would've gotten VB100%
with the correct database. On the plus side, a recent test of on-demand scanning by AV-Comparatives rated it ADVANCED,
the highest possible rating.

The combined antivirus and antispyware protection scans files on access, on demand, and on schedule. You can schedule
daily, weekly, or monthly scans and optionally set it to wait until the computer has been unused for a while before
starting a scan. If it finds a threat in your incoming e-mail it'll strip it out. If the threat is in an outgoing message,
it blocks the message completely.

A full scan of my standard clean test system took about 35 minutes, about the same as Panda Internet Security 2008 and
roughly half the time required by CA Internet Security Suite Plus 2008. This is a virtual machine with limited disk space,
so scanning takes longer than it would on most systems. Still, the times are useful for comparison.

In addition to scanning for known viruses and spyware, the System Control feature uses F-Secure's DeepGuard technology
to identify good and bad programs based on behavior. System Control kills undeniably dangerous processes right away and
reports its action in a small temporary window. If there's any doubt, it pops up a great big window explaining the details
of what it detected and asking you whether to trust the program. Norton and Panda use behavior-based analysis too, but they
manage to make the important decisions without hassling the user. I'd like to see F-Secure cut way back on those System
Control queries.

Installing FSIS on my malware-infested test systems took quite a while, because a lengthy update and additional reboot
were required to complete the install. Most of the systems handled the installation okay, but one unstable test system
snapped under the strain. It went into a blue-screen death cycle, crashing and rebooting again and again. I broke out of
the cycle into Safe Mode and checked with F-Secure to see what tech support would recommend. They suggested an online
scanner found on their Web site, and it totally solved the problem—impressive! For those who purchase the product as a
CD (instead of a download) another option is to boot from the CD and run a scan. The rescue CD boots a non-Windows OS,
so even the most pernicious rootkit is powerless to interfere with the cleanup. Another plus: Unlike Panda's rescue CD, this one can fix problems on NTFS-formatted drives.

When the scan is complete, FSIS offers to clean up the found threats by automatically applying its default actions. For
testing, I always chose "I want to decide item by item" instead of accepting the automatic cleanup. On the virus and
spyware pages, the default action is typically set to disinfect or quarantine; the default for "riskware" items such as
keyloggers is to take no action. I chose quarantine for all the riskware as well.

The combined virus and spyware scanner detected every single one of the malware samples on my infested test systems,
including the tough Trojans and rootkit samples. However, in a number of cases it didn't completely remove the
threat—meaning it didn't remove significant executable files—so it only got half-credit for those. The executable files
probably can't do anything without getting caught by the real-time protection, but there's no guarantee. You would know
that you'd had malware removed, but you would not know that it wasn't 100 percent removed. Even so, the app scored 8.8 out
of 10, just a hair behind the CA suite's 9.0 and a little ahead of the 8.6 scored by BitDefender Total Security 2008.
In a separate test using commercial keyloggers, FSIS recognized a little over half the samples but only fully removed
half of those it did recognize, for a final score of 4.5 out of 10. Panda got 2.1 of 10 on this same test, while Norton
Internet Security 2008 removed every single keylogger.