Win32 Virus Removal

I was pleasantly surprised during my recent evaluation of the latest antivirus tool from K7 Computing. It did quite a good job overall, though it still needs some work on cleaning up the malware it detects. That antivirus protection is the very best part of K7 Ultimate Security 11.0 ($69.96 direct for 3 licenses). Most of the other components in this security suite don't even come close.

The suite has the same flame-orange background as the standalone antivirus, but its main window naturally reflects the added security components. Each of six main security areas gets a status band with a green, yellow, or red icon indicating that area's status. You can expand one band at a time for status details on that area's components. This also exposes links to enable/disable or configure those components.

Antivirus Protection
As noted, the antivirus protection is exactly the same as that of K7 Antivirus Plus 11.0 ($39.96 direct, 4 stars). I'll summarize here; see the earlier review for full details.

Most of the independent labs have put K7 through testing. Overall it gets a fair rating from the labs. Others, including F-Secure and Symantec, have consistently scored much higher. The chart below summarizes test results for the current crop of antivirus programs. For details on how I derived this summary see How We Interpret Antivirus Lab Tests.

In my own testing, K7 installed quickly and scanned quickly. It detected 97 percent of the malware samples, better than any other individual product and matched only by the combined power of Norton 360 Version 5.0 (Free, 4.5 stars) and Norton Power Eraser (Free, 4 stars). However, it left behind some executable files and many non-executable files and Registry traces, enough to bring its malware removal score down to 7.5. Norton 360 and Norton Internet Security 2011 ($69.99 direct for three licenses, 4.5 stars) share the top score of 7.8, despite an initially lower detection rate.

Even though I used K7's separate rootkit scan it still scored only 7.6 for rootkit removal. It took 6.9 points in the scareware removal test, better than average but well below the top scorers. For full details on how I derive these scores see How We Test Malware Removal.

K7 did a good job keeping malware out of my standard clean test system, though its detection rate didn't beat the competition the way it did in malware removal. Its overall score of 9.0 for malware blocking is beaten only by Panda Cloud Anti-Virus 1.1 (Free, 4 stars) and Ad-Aware Pro Internet Security 9.0 ($29.95 direct, 4.5 stars), which took 9.1 and 9.2 points, respectively.

In the rootkit blocking test K7 fared poorly. Despite detecting all of the rootkit samples, it allowed two of them to install and run, and one of those managed to activate its rootkit technology. Its scareware blocking score was very good, but not the very best. For an explanation of how I derive these scores see How We Test Malware Blocking.

Endpoint Protection
Like the standalone K7 antivirus, K7 Total Security includes a handy endpoint protection feature. Called "Device Access," it lets you take control of how USB, diskette, and CD/DVD drives can be used. You can completely disable any of the three device types, require a password for use, prevent launching programs from the device, or make it read-only.

Additional options let you block autorun for USB devices and automatically scan each inserted USB device, with or without a confirmation prompt. A separate USB Vaccination feature modifies a USB drive so that no other program, malicious or otherwise, can install an autorun file.

Old-School Firewall
The suite's features that parallel K7's antivirus are the best part; from here it's all downhill. K7's firewall detects new networks and sets its configuration based on the now-expected choice of home, work, or public. In testing it passed all of my port-scan tests and other Web-based tests. That's an improvement over the firewall in K7 TotalSecurity Version 10.0 ($44.96 direct for three licenses, 2.5 stars), which didn't stealth all ports in its default configuration.

A firewall's program control feature determines exactly how much Internet and network access each program is allowed. Intelligent, modern firewalls handle this process internally. Norton allows all access for a vast number of known good programs, destroys known bad programs, and monitors the behavior of any unknowns. Kaspersky Internet Security 2011 ($79.95 direct for three licenses, 4 stars) categorizes programs and limits access to sensitive areas depending on the category.

K7 is nothing like these two. It uses the tired, ten-year-old technique of asking the user what to do about each program that requests Internet access. Of course, the average user has no clue, so most just routinely click Allow. K7 automatically allows all access for all programs during the first week and defines rules to continue those permissions once the week of automatic processing ends. This avoids the initial blizzard of popup queries. It also further dilutes your security, since bad programs as well as good will automatically get full network access.

Old-school program control only works if the firewall can detect programs when they access the network. Leak test tools check a firewall's ability to catch malicious programs that evade normal program control by forcing approved programs to do their dirty work, or pretending to be an approved program. K7 didn't detect any of my leak tests. They all connected successfully to the Internet behind its back.

The K7 firewall includes an intrusion detection component that watches out for specific network-based attacks, but the list is fairly small. I attacked it using the Core Impact penetration tool to generate almost 30 exploits against system vulnerabilities. K7 blocked almost a third of them, identifying them as exploits without specifically naming them. That's better than some, but Norton 360 blocked them all and identified them by name. Kaspersky PURE Total Security ($89.95 direct for three licenses, 4 stars) did the same for all but one.

At least the firewall won't succumb to attack by malicious software. None of my usual direct attacks succeeded, not even disabling its services by changing their startup status. It's an improvement over K7's previous suite, but not on par with the best firewalls.

This entry passed through the Full-Text RSS service — if this is your content and you're reading it on someone else's site, please read our FAQ page at fivefilters.org/content-only/faq.php
Five Filters featured article: Comment Is Free But Freedom Is Slavery - An Exchange With The Guardian's Economics Editor.