McAfee Internet Security Suite 2005: Upping the Ante for Security Suites VirusScan 9.0 and Personal Firewall Plus 6.0 Joseph Moran
VirusScan
McAfee's VirusScan component integrates into Windows Explorer and Microsoft Outlook/Outlook Express (as well as some less common e-mail clients like Eudora and Pegasus), allowing you to easily perform scans on individual files or messages. For real-time protection, VirusScan's ActiveShield feature automatically monitors files (including e-mails, attachments, and files incoming from instant messaging software) for virus infection. Once an infection is located, you have the option of attempting to clean the file or quarantining or deleting it if the infection can't be removed.
Besides watching out for known viruses, VirusScan also monitors your system for suspicious and virus-like activity, including those perpetrated by scripts and worms. Examples of this include surreptitious accessing of the Windows Registry, sending an e-mail to a large group of people from the address book, or the rapid queuing of lots of individual messages in your outbox.
As is the case with F-Secure's Internet Security product, McAfee's anti-spyware software is not a standalone utility but is rather integrated with the anti-virus component. It successfully identified a number of stowaway applications on our test computer, and was able to summarily delete them rather than simply rename them like F-Secure's anti-spyware system does.
The anti-malware software purports to detect and remove a variety of potentially unwanted applications (PUPs), including key-loggers, Web dialers, pop-ups, and adware that can secretly track personally identifiable information as well as slow your Web surfing. In addition to the integrated malware detection and removal capabilities, the 2005 edition of VirusScan (v9.0) also features improved email scanning, with more effective handling of larger file sizes and better integration with most popular email clients.
Personal Firewall Plus
A big part of any software firewall's job is to monitor for attempts to access the Internet and then prompt the user regarding whether to permit or deny that access to an application. McAfee's Personal Firewall Plus provides five security levels ranging from Open, which offers no protection, to lockdown, which allows no network traffic flow. The median (and default) setting is Standard, which prompts you for confirmation before allowing applications Internet access.
But as is typically the case when prompted by a firewall to confirm an application's access attempt, it's not always clear what the program is or what its intentions are, which can lead users to blithely choose yes for every prompt or unintentionally disable features of legitimate applications by denying access to legitimate applications.
Personal Firewall Plus 2005 tries to take some of the guesswork out of this decision with a new feature called Smart Recommendations. When enabled – as it is by default – the firewall will automatically check a database at Hackerwatch.org to determine the identity and nature of the application, and then automatically grant access if the program is kosher. (Alternatively, it can simply inform you of its finding and still give you the final decision.)
The Smart Recommendations feature worked well most of the time, but it needs a more comprehensive database. It enabled access to Windows OS components and integrated applications without any prompting, but was unable to identify many third-party applications we tried.
One attention-grabbing feature of Personal Firewall Plus is its ability to trace the origin of a suspected attack and in some cases perform a WHOIS lookup of the offending IP address. This capability may not have tremendous value to the average user, but it is cool for technophiles, and you also have the option to report dubious activity (again, to HackerWatch.org).
Some advanced users will likely be frustrated with the customizability (or lack thereof) of Personal Firewall Plus. For example, you can grant an application full access, no access, or outbound access only, but there's no way to tailor the access privileges of a particular program to allow access on some ports while denying others.
