Norman Virus Control 5.2 By Larry J. Seltzer June 11, 2002

• Product: Norman Virus Control 5.2
• Price: With one-year subscription, $59 direct
• Company Info: Norman Data Defense Systems Inc., 703-267-6109, www.norman.com

Editor Rating:

There's a lot that's promising in Norman Virus Control 5.2 (NVC), not the least of which is minimal impact on system performance. But the program could stand some modern touches and usability improvements. Though NVC is affordable and extremely configurable, it is fairly difficult to use.

Once you install the software, you should run the Norman Internet Update, which downloads updates to the software and virus definitions. Unlike most other programs here, NVC does not automatically run this program after installation.

NVC uses a special sandbox engine that is invoked when the software detects suspicious program behavior—specifically, self-modifying code. At first, we were concerned that this approach would create a burden on the system. Our Content Creation Winstone tests showed otherwise, with NVC causing the smallest performance hit among any of the products.

Many of the antivirus programs provide the configuration processes in a single application, attempting to make the software as simple as possible. NVC uses several applications with a large number of configuration options, and some of the preferences overlap unnecessarily between programs.

The configuration editor lets you schedule updates to run once per day or on connection to the Internet. You can also download updates manually or set up your own network server to deliver updates to multiple machines automatically.

The configuration editor includes more extensive options than any other product here. We could, for example, set different behaviors for the on-access scanner in interactive circumstances, such as when you're logged on and at the console, and noninteractive circumstances, such as when you're not logged on. There are also sophisticated options for virus notifications.

We used the Task Editor to define scanning tasks, although you can also scan ad hoc in Windows Explorer. After defining a task, you can specify many options, as well as schedule the task. There are also predefined tasks to scan a floppy disk and all hard drives. Unfortunately, there are no prescheduled tasks.

Another risky shortcoming is that although NVC scans mail attachments when you access or execute them, it doesn't scan the actual SMTP or POP streams. This means you could, for example, receive an infected message and forward it without detection.