Perfect scores in our malware and exploit protection tests. Best score in our malicious URL blocking test. Includes spam filter, password manager, and other bonus features.
Full scan unusually slow. Limited tech support.
- Bottom Line
Symantec Norton AntiVirus Basic blows the tires off our hands-on tests, and it offers a large collection of bonus features. It remains an antivirus Editors' Choice.
Symantec's Norton brand is one of the best-known in the antivirus realm. Norton AntiVirus has been around since the early 90's, in one form or another. The current edition of Symantec Norton AntiVirus Basic aced our hands-on tests, and, despite the "basic" in the name, it includes some unusual advanced features. It remains an antivirus Editors' Choice.
//Compare Similar Products
This PC-specific product costs $49.95 per year, up $10 since last year, and there's no multi-license pricing. Bitdefender, Trend Micro, and Webroot all go for $39.99. McAfee costs $59.99, but that subscription gets you protection for every device in your household. Tech support for Norton AntiVirus Basic is limited, and you don't get the Virus Protection Promise. It's pretty clear that Symantec would really prefer that you purchase Symantec Norton Security Premium or one of the other suite products. The suites do cost quite a bit more, though, so if you just need to protect one PC, choosing the antivirus makes sense.
As with McAfee AntiVirus Plus and many modern security utilities, the easiest way to install Norton is to go online and register your product key. Doing so gets you a simple choice; install on this device, or send an email to install on another device. You download a tiny installer stub which in turn downloads the latest product. I did find that checking for updates immediately after installation found 18 updates and a patch, even though the main window said, "Protection Updates: Current."
There's a bit more to getting the product fully installed. When you launch a browser, Norton prompts you to install not one but four extensions: Norton Safe Search, which marks dangerous search results; Norton Home Page, which puts Safe Search and a collection of quick links on your home page; Norton Toolbar, which rates the pages you visit and includes a search box; and Norton Identity Safe, a full-scale password manager. Norton makes installing the extensions very simple, with a hand-holding wizard that leads you through every step. Once you've set up all your browsers, your installation is complete.
At first glance, the product's main window seems unchanged since last year, but there's one very handy new feature. Have you ever gotten frustrated flipping through pages of settings and not finding the one you want? Now you just click on the search icon and start typing what you're looking for. You'll get a list of matching topics with an explainer panel that pops up when you point to one. You can perform some simple actions, like turning a feature on or off right in the search box.
The new Help Center puts a wealth of support resources at your fingertips. You can watch video tutorials, read the manual, and check for new versions. Clicking to get support automatically runs a diagnostic tool that can fix some problems. If it can't, it offers a link to online tech support. Other links let you manage your account, visit the Norton community forums, and more.
With most antivirus tools, you can choose three types of scan. The full scan, as the name implies, checks everything on your computer. The quick scan focuses on malware in memory and in common malware haunts. For a custom scan, you specify where and how it should check for malware.
Norton gives you all three of those, but it doesn't stop there. If you still feel that you have malware even after a regular full scan, you can launch the aggressive Norton Power Eraser tool. There's a faint possibility this tool could damage legitimate programs, and Norton warns you about this. For maximum malware-fighting power, it reboots the system and scans at startup.
Norton Insight scans your files, checking them against Symantec's monster database of known good files. Trusted files don't need to be scanned; they've already been verified as good. For each file, the Trust Level report lists the level of trust, the number of users (among Norton customers) and the impact on system resources.
If you're having trouble that requires contacting tech support, take a moment first to run the Diagnostic Report scan. It may help you solve the problem on your own. If not, the data in the report can help the support agent sort out your troubles.
I timed a full antivirus scan on my standard clean virtual machine. It took an hour and 50 minutes, more than twice the current average of 45 minutes. As with many products, a second scan ran faster, but in Norton's case that repeat scan still took 48 minutes. BullGuard finished a repeat scan in five minutes, Kaspersky in four, and ESET NOD32 Antivirus took just 30 seconds.
A Norton Insight scan reported that 94 percent of my files are trustworthy, meaning the scan could skip them. However, a full scan afterward didn't run any more quickly. My Symantec contact explained that "engineering recently made some changes that appear to have inadvertently slowed down certain scans," and that they're working to resolve the problem. Once you've made a full scan, real-time protection should take care of any new problems, so a long scan time isn't a serious problem.
Scores From Excellent to Perfect
Norton relies on many factors when checking for malicious files, including the source of the file. A file downloaded from the internet gets more intense scrutiny than one that was sitting in a folder before antivirus installation. And that makes sense. Rather than just opening an existing folder of malware samples, I put the folder in my Dropbox cloud storage and downloaded it to the test computer. I mixed a collection of uncommon but legitimate utilities with the malware. Going forward, I'll do all my malware testing this way.
Norton started picking off samples as soon as the download finished. After a few minutes, it had eliminated all but one of them, while leaving the legitimate files alone. When I launched the one holdout, Norton detected and disinfected it. That makes Norton the only product to earn a perfect 10 points against this set of samples by detecting them as malware. Yes, PC Pitstop PC Matic managed 10 points, blocking them all, but only because they were not on its whitelist. It blocks any unknown program, good or bad.
Tested using my previous collection of samples, several products managed 100 percent detection. Webroot and Comodo Antivirus completely blocked every detected sample, thereby earning 10 of 10 possible points.
My malicious URL blocking test evaluates how well an antivirus prevents internet-based malware from infesting the test computer. This test starts with a feed of malware-hosting URLs supplied by MRG-Effitas. I use the very latest URLs, usually no more than 24 hours old. I launch each URL and note whether the antivirus blocks access in the browser, eliminates the download, or does nothing. When I have 100 valid data points, it's time to check the results.
For most of the test, Norton's detection remained evenly balanced between blocking URLs and eliminating downloads. It caught some downloads before I even clicked Save. it quarantined others shortly after the download finished. In all, it blocked 54 percent of the samples at the URL level and 44 percent during download, for a total of 98 percent protection. That's the same score it achieved last time, and still the best of any current product. Trend Micro Antivirus+ Security came very close, with 97 percent protection.
Norton took the top score in my malicious URL blocking test, and the highest possible score in my malware protection test. That's quite a feat.
Decent Lab Results
I mentioned that the full power of Norton's malware detection relies on many factors, including the source of a file. When confronted with a static collection of samples, it doesn't necessarily work as well as in a real-world situation. That's the reason Symantec gives for its good-not-great scores in some tests by independent antivirus labs.
Let's start with the bad news. MRG-Effitas runs two tests, one specific to banking Trojans and one using a variety of malware types. A product that doesn't achieve near-perfect protection simply fails. Nearly three quarters of tested products failed the banking Trojans test, and half failed the general malware test. Norton was among those that failed both. Because of the pass/fail nature of this test, however, I give it less weight when calculating an aggregate score.
AV-Test Institute scores antivirus products on three criteria, awarding up to six points for each. Norton took the full six points in the all-important Protection test. It managed 5.5 points for Performance. And a few false positives brought its Usability score to 5.5. Its total of 17 points is quite good, but Kaspersky Anti-Virus managed a perfect 18.
I follow four tests administered by AV-Comparatives; Norton participates in two of them. Rather than a numeric score, this lab assigns Standard certification to any product that passes. Those that do more than the minimum can earn Advanced or Advanced+ certification. Norton got Advanced+ certification in both of the tests.
Norton's aggregate lab score of 8.9 points is decent, but Kaspersky Anti-Virus got a perfect 10 points based on all four labs that I follow. Bitdefender Antivirus Plus is close behind, with 9.9 points.
Winning Against Phishing
You don't need any special malware coding skills to create a phishing website. You just need to be good at copying existing secure sites, and at tricking people into logging in to your fraudulent site. Once they do, you can use their credentials to own the real account. Yes, this trickery relies on victims not noticing that the URL in the Address Bar for their banking site is actually www.RipYouOff.ru, but if even a few suckers fall for it, the fraudster wins.
Norton was one of the early security products to include phishing-specific protection, and it's been consistently excellent, using a blacklist for known frauds and heuristic detection of brand-new ones. In my testing, I normally compare a products detection rate against Norton's, and against the phishing protection built into Chrome, Firefox, and Internet Explorer.
Rather than test Norton against itself, I calculated its score by mining my existing data. If a product's detection rate lagged Norton's by 30 percent and Chrome's by 20 percent, Norton's detection rate was 10 percent higher than Chrome's. The figures in the chart come from applying that logic to all current products and averaging the results.
Very few products have outscored Norton on this test—in fact one in five scores lower than all three browsers. Webroot SecureAnywhere AntiVirus's detection rate came in one percentage better than Norton's, and Trend Micro did three points better. Perhaps catching Norton on a bad day, Bitdefender outperformed Norton by a full 12 percentage points.
Top-Notch Intrusion Prevention
Hackers exploit security vulnerabilities in Windows and in popular programs to gain access to other people's computers. Depending on the vulnerability, they might be able to steal your data, or plant other malware on the system. Exploit protection is usually associated with the firewall component, but this firewall-free antivirus has the same Intrusion Prevention found in the full Norton suites.
To measure this feature's effectiveness, I hit the test virtual machine with about 30 exploits generated by the CORE Impact penetration tool. Norton blocked every single one of them in a clean sweep. For most, it just reported a generic web attack, but in a couple of cases it displayed the official name from the Common Vulnerabilities and Exposures list.
Blocking exploits at the network level keeps the attack from even coming near your computer, and Norton did a perfect job. Next-closest among recent products was Kaspersky Internet Security, with 73 percent protection. Note that none of these exploits actually had a chance of infecting the fully-patched test system.
Many Bonus Features
Norton's antivirus includes the same antispam component found in the full-blown Norton suites. It filters out spam from POP3 email accounts and integrates with Microsoft Outlook. In Outlook, it automatically moves spam to the Norton AntiSpam folder. If you use a different email client, you need to create a message rule to divert messages marked as spam in the subject line. You can whitelist your correspondents so their mail never gets tossed, or blacklist known spammers. If your email provider doesn't filter out spam before it reaches you, this can be useful.
When you install Norton AntiVirus, you also get Symantec Norton Identity Safe. That's not precisely a bonus, since you can get Identity Safe for free, but it's a nice addition. Read my review for full details. Briefly, Identity Safe handles basic password manager tasks such as password capture, password replay, and filling web forms, and it can sync your data across all your Windows, Android, and iOS devices. However, it lacks many advanced features, among them secure password sharing, two-factor authentication, and automatic password changing.
Many programs configure themselves to launch every time you boot up the computer, just in case you might need them. But do you really need them sucking up CPU cycles all the time? Norton's Startup Manager lists all your startup programs, along with information about resource usage and prevalence in the Norton community. You can reversibly disable any item from launching at startup, or set it to launch after a delay.
Modern Windows versions work in the background to avoid disk fragmentation. Even so, Norton still offers an Optimize Disk feature. When you launch this component, it first analyzes the drive for fragmentation, only proceeding if defragging would be worthwhile.
If you feel that your PC is running more slowly than it used to, try launching the File Cleanup tool. But don't expect the thorough cleaning you get with a full-scale tune-up utility. The cleanup component simply deletes Windows temporary files and browser temporary files.
More Than Just Antivirus
Norton Antivirus Basic earned the top score in my malicious URL blocking test, and took a perfect score both for malware protection and for blocking exploits. Among its many bonus features are a spam filter, a password manager, and a toolbar that rates links in search results. You don't get the 24/7 tech support or Virus Protection Promise that comes with Norton's suites, but if you just need to protect one PC, it's a gem, and an Editors' Choice for antivirus.
The crowded field of antivirus products has room at the top. Kaspersky Anti-Virus and Bitdefender Antivirus Plus get excellent scores from all the independent testing labs that I follow. Webroot SecureAnywhere AntiVirus is the tiniest antivirus around, and its unusual behavior-based detection system extends to ransomware protection. And one license for McAfee AntiVirus Plus lets you install protection on all your devices. Each of these has its own merits, and each is an Editors' Choice.
Other Symantec Antivirus Software
Neil Rubenking served as vice president and president of the San Francisco PC User Group for three years when the IBM PC was brand new. He was present at the formation of the Association of Shareware Professionals, and served on its board of directors. In 1986, PC Magazine brought Neil on board to handle the torrent of Turbo Pascal tips submitted by readers. By 1990, he had become PC Magazine's technical editor, and a coast-to-coast telecommuter. His "User to User" column supplied readers with tips… More »
More Stories by Neil J.
- Trend Micro Antivirus+ Security
- Trend Micro Password Manager
- McAfee AntiVirus Plus