Network Computingwww.networkcomputing.com

Side Bars

Executive Summary: Gateway Virus Scanning How We Tested Antivirus Software

PDF Charts

Antivirus Test Results Antivirus Software Features

Related Links

Network Computing, Sept. 15, 1998 "Wanted Dead or Alive: The Antivirus Shoot-Out" InternetWeek, April 23, 1998 "Trend Micro Intros Web-Based Antivirus Control System" InternetWeek, Feb. 2, 1998 "Boost NT's Virus Immunity" Network Computing, Aug. 1, 1998 "You Can Claim Victory Over Viruses"

Other Reviews this issue

RADWARE FireProof Balances Firewall Loads With Minimal Complexity By Gregory Yerxa

Company Directory

Browse our directory to get data, starting with a particular company.

Reader Service

Allows you to request additional product information from our advertisers.

Print The Full Article

ClickHere

E-mail this URL

ClickHere

Buy the Book

		our customizable newsletter, sends you security alerts, product updates and software patches on the products you use. Sign up now at www.networkcomputing.com /express/

Before the advent of gateway antivirus products, administrators counted on client-side virus-scanning packages or, at best, server-side scanners. These solutions primarily scan for viruses that have reached company servers and desktops, both environments from which a viral infection can all too easily be unleashed sitewide. Firewall vendors have begun to offer more aggressive protection against hostile code at the gateway level, but this usually isn't a primary concern.

The bottom line is this: If your organization is serious about fighting viruses, invest in a gateway solution. Remember, too, that gateway antivirus products can only stop network-borne viruses, so you'll need to maintain your server-side and client-based antivirus solutions. And there's one more hitch--the products in this space aren't quite mature. Although the products we tested were able to fend off most of the viruses in our tests, no package had a 100 percent success rate.

We evaluated three SMTP gateway antivirus products--Command Software Systems' m@ilCOMMAND, Symantec Corp.'s Norton AntiVirus for Internet Email Gateways and Trend Micro Corp.'s InterScan VirusWall--in our Syracuse University Real-World Labs®.

Click to view the Report card on Antivirus Protection for SMTP Gateways
We wanted to include Network Associates' offerings but were prevented from doing so by timing and the aftermath of a corporate acquisition. We put off our tests for months waiting for WebShield 4.02, but we finally went ahead without it. About the time you read this, Network Associates will have released WebShield 4.02.

The three products we tested offer real-time scanning of inbound and outbound SMTP traffic, remote management interfaces, sender/receiver notification and updated virus patterns. Other features, such as spam filtering and content filtering, are available as part of add-on packages or are being promised in upgrades. All three are ICSA-certified and are capable of detecting viruses found on the WildList. Overseen by the WildList Organization (www.wildlist.org/WildList/199902.html), this list is a compendium of computer viruses reported by volunteers.

All three products displayed problems with platform support, mail relay and filtering. None detected Macintosh or Linux viruses. The control of mail relay and mail filtering was at times difficult to customize and could lead to integration headaches in scaled environments. Some of the products need a more developed interface to be useful in an enterprise setting.

Despite these weaknesses, Trend Micro's InterScan VirusWall 3.1 stands far above its competition, and takes our Editor's Choice award. VirusWall incorporates 19 compression algorithms to detect the most common methods for sending attached files. Detecting and processing 19 compression schemes means there is little chance a virus will get through. The other two packages only detected the most common compression schemes, such as TAR and ZIP.

VirusWall not only detects the most common viruses, but stays ahead of the curve by ferreting out new means of viral infection, including hostile applets, JavaScript, VBScript and the most recent HTML infectors. VirusWall detected more of these viruses and offers the only hostile-applet scanning code among the three products we tested. While not perfect, the interface was the most convenient and intuitive we saw, with only a slight learning curve. Trend Micro also offers the separate Trend Virus Control System (VCS), which provides Web-based remote administration and a slew of additional features.

It appears that Symantec's Norton AntiVirus for Internet Email Gateways and Command's m@ilCOMMAND are still in the design phase. Symantec officials told us the company plans to release an extensive upgrade next quarter. However, they declined to provide other details.

Both the Symantec and Command releases have several bugs to work out. If the version dates are correct, Norton's software has not changed since its 1.0.2 upgrade in 1997, and it was incomplete and problematic from the moment we installed it on our test system. Command's product is stronger, offering excellent mail handling and log configuration. M@ilCOMMAND also uses a comprehensive F-PROT engine for virus detection. With a little work on the user interface, Command could provide serious competition for Trend Micro.