This week’s test drive is the recently released F-Secure Total Security 2012. As usual, upon installing it and updating its signature file, I proceeded to throw the computer at malicious websites to see how effective F-Secure was in thwarting the malware therein.

First round: downloaded a program right out of a Russian website, and emulating a gullible computer user, proceeded trying to open the program just downloaded. F-Secure real-time protection module jumped, blocked it from opening, alerted me to its existence, and nuked it. A posterior in-depth analysis revealed the program was indeed never allowed to open, so no damage to the computer. First round: Pass.

Second round: A fresh Trojan. Same behavior, same result as first round.

Third round: Another very nasty Trojan, the most frequent type of malware these days. Same result, the real-time protection module didn’t even let the file finish downloading and rendered it harmless. Pass!

Fourth round: A fake antivirus. Same result: No luck in infecting the computer. It became obvious that these attempts to infect the computer were pretty much useless. I actually ran out of malicious websites to throw the computer at! And despite all the efforts, not only did the computer not get infected with any payload, the files containing malware were not allowed to stay in the computer, in fact they weren’t even allowed to arrive at the computer. Because no malicious file was allowed to open (execute), some of the security layers were not even called upon! (Like the firewall).

Conclusion

Similar to my recent review of Lavasoft’s product, F-Secure passed the test but at the cost of some system performance impact: I spotted 12 different processes running in the background when F-Secure is running. That’s a lot of processes for just one program. And even though my test computer is fast, I was able to clearly perceive the performance degradation once F-Secure was installed. So users with old or slow computers might want to stay away.

The updated list of security products that have passed my test follows. The sequence is simply the order in which they have been tested and does not represent any kind of performance score:

1. Kaspersky Internet Security 2012.

2. VIPRE Antivirus Premium.

3. ZoneAlarm Extreme Security Suite 2012.

4. Avira Internet Security Suite 2012.

5. Emsisoft Internet Security Pack.

6. Lavasoft’s Ad-Aware Total Security Suite 2011.

7. F-Secure Total Security 2012.

And remember, any of the above products provide enough protection to keep you safe while surfing the web IF complemented with AppGuard, as laid out in my article from over 2 years ago on the subject.

This week’s test drive is Ad-Aware Total Security Suite 2011. Also flaunting dual scan engines like last week’s test drive subject, The installer was a little intimidating at almost 400 Megabytes!

For the purpose of this test, I left all settings as they came when first installing, except the firewall, which I set to high security. And then the fun began. As usual, the test consists of trying to infect the test computer by visiting known malicious websites and observing the security product behavior when doing so.

Went to the first malicious website, containing a fake antivirus. Loading the website lagged momentarily (Ad-Aware was checking the content of the website before allowing access) and then denied access to the malicious website, announcing through a pop-up window there was malicious content and access had been denied. HOWEVER, I did get prompted to download a file (info.exe) and when, emulating a less than expert user, I clicked to download it and save it, it did so. And then when I tried to open it, there was no protest from Ad-Aware!

The only reason why the computer did not get infected when doing that was, well, a technical unrelated reason. Just to make sure the file was indeed malicious, I submitted it to a website that checks any given file against 36 different scan engines from different security companies. To be fair, only ONE scan engine labeled the file as malicious. So what we had here was a very new infection that had not made its way yet to the signature files of most scan engines. But regardless, it was a miss and the behavioral (heuristic) module should have detected it. Because of the technical reason that impeded its execution, we’ll give it the benefit of the doubt and not flunk it right away, but keep on testing.

Second try, malicious page on a youtube.com link (very popular these days). One of the scanning engines successfully spotted the maliciousness and denied access to the website altogether, both popping up a window and placing a message smack in the middle of the browser instead of the intended page, letting the user know the link was a malicious one. Pass on this one.

Third round: A Trojan hidden in a malicious website. Similar result to the first round. In fact, so similar, I took the malicious file and executed in a controlled, yet uninhibited environment (a “sandbox”) and soon realized it was basically the same file with a different name. Moving along then.

Fourth round: A different, very malicious type of Trojan, hidden in a Russian website. Ad-Aware successfully identified the malicious code and denied access to the website altogether. Good.

Fifth, sixth, seventh rounds: Like the second round.

Conclusion:

The test drive is considered a pass, since no infection occurred and no malicious payload delivery occurred, and no breach of data or behind the scenes connection happened, no matter the attempts to do so.

A note on system resources usage: I counted 9 different processes running in the background to make Ad-Aware Total Security Suite work, with over 400 Megabytes of system memory being used altogether. So needless to say, old computers with relatively low memory should stay away. Newer computers, with plenty of system memory, won’t mind (My test computer, for example, has about 8,000 Megabytes of memory, so it’s undisturbed by a process using 400 Mb).

So that being said, we can add Lavasoft’s Ad-Aware to the list of security suites that have survived unscathed my test drive. These are, in the order they have been tested:

1. Kaspersky Internet Security 2012.

2. VIPRE Antivirus Premium.

3. ZoneAlarm Extreme Security Suite 2012.

4. Avira Internet Security Suite 2012.

5. Emsisoft Internet Security Pack.

6. Lavasoft’s Ad-Aware Total Security Suite 2011.

Stay tuned for more test drives in the near future. Next one is probably going to be F-Secure, which releases its 2012 version next week.

Following the series of test drives that I’ve been performing on the main brands’ security suites, this time I tested Emsisoft Internet Security Pack. As it is usual with the top security product from a company, Emsisoft’s security pack  includes anti-virus (2 separate scanning engines to be precise) a firewall, web filter and so forth.

After installing it, I put it to my classic acid test of visiting known malicious websites to observe how it behaves in a dangerous environment. I must say I tried multiple times to infect the computer, and all the attempts were thwarted by either the real-time protection module, or the web filter. Read on for what I found to be the problem with this product.

Although this product passed the test described above with flying colors, the problem I found with Emsisoft is its over-restricted and awkward approach to security. Every time ANY program tried to access the Internet, modify the registry, or otherwise perform any questionable action, a pop-up window came up alerting me to it and asking me to make a decision. And the worst part is, even though there was a checkbox to have Emsisoft remember my answer so I would not be prompted again when the same operation repeated, I kept being prompted again for a decision on things I had already decided what course of action to take, AND had told Emsisoft to remember my answer. Glitchy and awkward.

Along that line, I have tried the firewall before, as a stand-alone installation, and besides the above nuisance, I found the firewall to be very resource-hugging and a specific application installed in my computer, for no reason at all, decreased in performance about 2,000%. It was hard to track down too, as there was no evidence connecting the presence of the firewall to the degraded performance of the application, and only through a trial test was I able to ascertain that indeed the firewall was the culprit.

So although a pass on the test drive, I’d stay away from it in terms of the user experience.

Recently released, Avira Internet Security 2012 was taken for a ride. As usual, the test drive consisted of installing the tested program in my test computer, then accessing known malicious websites and their respective malicious files, and in general trying to infect the computer and see what the security program does to counter the effort.

When I first tested Avira (the 2011 version), it failed miserably. Not this time around. No sir. I installed it and left the firewall setting in its default setting, but did change the behavioral detection level to its highest sensitivity setting. And then the fun began.

First round: accessed malicious website, was prompted to download a file, did so. Successfully finished downloading the malicious file, proceeded to open it… And Avira’s real-time protection module jumped to alert me that the program I had just tried to open was a Trojan and should be quarantined. No infection got through. Pretty good.

Second round: similar scenario (but different website), this time WHILE downloading the file and before attempting to open it, the real-time protection module alerted to the maliciousness of the file. Wow, that was even better.

Third round: Somewhat similar, except this time when trying to ACCESS the malicious website, before being even able to start downloading the infection, I was denied access to it by Avira’s web filter module. This was getting better at every attempt!

Fourth to tenth rounds: same as 3rd round.

All different websites, not one infection got through. In fact, no malicious program was even allowed to open!

None of my attempts to infect the computer succeeded. Quite a change compared to the 2011 product!

Conclusion

A triumphant pass, making Avira Internet Security Suite 2012 join the ranks of those security programs that have pass my test. So the list now goes:

1. Kaspersky Internet Security 2012.

2. VIPRE Antivirus Premium.

3. ZoneAlarm Extreme Security Suite 2012.

4. Avira Internet Security Suite 2012.

All trustworthy and recommended.

After my latest article was published last week, I received feedback from some of my readers asking me for clarification of how the stolen certificates situation I talked about in it translated to the average Joe/Jane user. What would he/she run into and what can he/she do?

Let’s see how it would work in a real case scenario. Let’s say, for example, you want to sign in to your gmail email. You’d go to a secure (encrypted) webpage, like

https://www.google.com/accounts/ServiceLogin?service=mail&passive=true&rm=false&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F%3Fui%3Dhtml%26zy%3Dl&bsv=llya694le36z&ss=1&scc=1&ltmpl=default&ltmplcache=2&from=login

And from there provide your email address and password. But even before you do that, as soon as you click on the above link, your browser will check the certificate presented by the website, and thus corroborate that indeed, the website is legitimately what it purports itself to be. This all occurs behind the scenes, so to speak. The user does not see this process. However, if for some reason the certificate is expired, is different than expected or contains any other outpoints, the browser will alert you. In Firefox (for example), you might see something like:

You would then be able to avert the impersonation. And that’s how certs help you.

Now, if a cert is stolen and used in, let’s say, a phishing email, and you click on a link of what seems to be a gmail login, but it’s something else, AND it is using the stolen cert, you would not get the alert and thus not realize these are not the androids you’re looking for (Go see Star Wars Episode IV if you don’t get the reference 🙂 ). And so you sign in and thus give the malicious hackers your credentials.

That’s just one possible way of how stolen certs could be used for malicious purposes.

I mentioned in my last article Windows XP and Server 2003 users were the most likely to get affected. Microsoft has just released a Windows Update (KB2607712) that permanently blocks all certificates issued by DigiNotar. The update should be available to you if you have automatic updates enabled in your computer. If you don’t, want to install it manually, and know what you’re doing, here’s the link to it:

http://support.microsoft.com/kb/2607712

If you have any questions, don’t hesitate to ask.