Network Computingwww.networkcomputing.com

Both Trend Micro and Symantec offer automatic pattern updating to make management easier. While Trend Micro offers scheduled pattern updates, which occur without user intervention, Symantec requires the push of a button. After clicking the LiveUpdate button the program confirmed our update and assured us we were current. But upon further investigation, we noticed that the pattern files were dated 1997.

After several failed attempts in our lab, we managed to resolve the problem with a call to Symantec. The representatives were helpful and provided us with an update but no explanation. Even with the problem resolved, Norton's status window reported incorrect details about our pattern files. Only by checking file sizes and time stamps could we be sure our system had been updated.

Even the legitimacy of Norton's claim to NCSA certification seems to need updating. The NCSA was the original incarnation of the ICSA before it changed its name in 1997. In our tests, AntiVirus for Internet Email Gateways only detected nine of 18 viruses from the WildList. This sort of performance would make the product invalid for either NCSA or ICSA certification. In addition, Norton provided limited support for compressed attachments. In our tests, only UUE, MIME and ZIP files were detected. The software could not handle self-extracting archives, TAR or GZIP files.

Norton's system for scanning and handling infected attachments is a messy one. All incoming attachments are scanned as usual, but if any file in a group of attached messages is found to be infected, every attachment is discarded.

Beyond these glaring faults, the product offers a rather rudimentary implementation. A Web-based interface is the only way to configure the system other than manually editing .INI files. The Web interface can ease remote administration and is a smart option to include in any gateway scanner. But the lack of a desktop client is bothersome when working directly on the server. Our tests also showed different results depending on the Web browser we used. In some instances, Norton's quarantine window would not display on our browsers, which limited our ability to work with the product.

Norton's quarantine option seemed intuitive at first. It allows infected files to be set aside, rather than deleted, until the file is cleaned. When an infection occurs, Norton is supposed to be able to repair or strip the file. Our tests found that Norton would always strip the infected attachment rather than attempt to clean it. This proved to be a waste of system resources, and most administrators will probably disable the feature and simply delete the infected attachments outright.

In terms of virus administration, Norton's log files were too well-structured. The program quickly generated overly formatted logs that took a long time to load when viewed via the Web interface. The logging system also lacked any automation for log rotation or processing, which both VirusWall and m@ilCOMMAND do well.

While its virus detection is fair, Norton AntiVirus for Internet Email Gateways is lacking in too many key areas to be considered a viable option for SMTP gateways. Features like the default Web interface get a nod for ease of use, but too many bugs, quirks and problems leave this program in need of a serious update.

Jeffrey H. Rubin is an adjunct professor at the School of Information Studies at Syracuse University and a consultant for Internet Consulting Services. Timothy M. O'Shea is an independent consultant. Send your comments on this article to Rubin at jhrubin@internetconsult.com or O'Shea at tmoshea@mailbox.syr.edu.