Norton 2011 released (early releases only - see new thread)

Re: Norton 2011 released

As a matter of fact this one is way better made

 

Re: Norton 2011 released

well i have to say that this video is really well presented

 

Re: Norton 2011 released

This video shows Sonar's ability to detect and block unknown malware. I'd like to remind you that Sonar is quite useless without an internet connection (Norton's cloud and insight information).

You can try that yourself:

1. Shutdown Insight protection, Download intelligence and Sonar.
2. Download malware and disconnect (you may skip part 1 and download zipped/rared malware).
3. Run the malware: Sonar won't detect it (while disconnected, you may activate Insight protection & Download intelligence).

P.S: It is important to avoid Norton's Insight queries regarding the downloaded malware, as this information will be stored for sonar to use it offline.

Made some tests on some new malware this way, and the results (based on signatures and pure heuristics) were horrible

I won't recommend the product to clients that aren't connected, most of the time, to the internet.

 

Re: Norton 2011 released

I assumed that the whole purpose of pulse-updates was to bridge this gap - offline vs online. Seems like a marketing gimmic now.

 

Re: Norton 2011 released

NIS 2010 is better than NIS 2011 (a little)

 

Re: Norton 2011 released

The update to the 2011 versions is now available to current subscribers as far back as NIS and NAV 2006.

 

Re: Norton 2011 released

This is where I see Norton improving. How does this stuff work with other vendors?

 

Re: Norton 2011 released

It's either done at traffic level (scanning the HTTP stream, browser independent; Eset, Avira, Kaspersky etc. use this) or at packet level (Norton, also browser independent).
When working at traffic level and scanning the HTTP stream, the scanner employs signatures, generics and heuristics on objects coming via HTTP, before they hit the HD, be it PE files or scripts. The "downside" of this method is slight browsing slowdown. Packet level filtering of data coming from the internet doesn't have that downside (according to Norton) but it doesn't scan downloaded objects (.exe, .zip etc.) before they hit the HD. Both methods are good at what they're supposed to do: prevent the browser from parsing malicious code (scripts, exploits etc.), which is mainly important for exploits which don't require to be stored on the HD to work.
For ex. heuristic detection of the Fake scanner page script:

 

Re: Norton 2011 released

I think this one is the only review so far of final 2011 , it's nice and good.
The guy is funny with kinda robotic voice and strange accent, really fun to watch

-- http://www.youtube.com/watch?v=NELVnfycd9c --

 

Re: Norton 2011 released

Oh, thanks! I've never seen what other solutions do confronted with this. What does the browser look like when Kaspersky does that?

Norton used to miss a lot of that stuff not so long ago - they've been very crafty when designing a low footprint app, but their detection got better relatively recently.

This, and on-access scanning is what needs to be good, better and constantly improving. Scanning is a waste of time and hard disk cycles.

@ pabrate
There's been a proliferation of testers on the internets recently. Just a year ago it was just mrizos with his VM, now every neighborhood kid wants a piece of the action.

 

Re: Norton 2011 released

Seems like a teen to me
The results of MBAM at the end seems suspicious to me - what does it detect in vmware's DnD folder

Dnd folder is vmware's drag and drop function to exchange files between host and guest . He didn't exchange any files druing the video so this won't trigger any Norton alert , nor he started a file with that name as detected in VMware's DnD folder

The second one called test.exe was actually stopped by the user thanks to the alert from Download Insight (he chose to stop the file per Norton recommendation not to use the new file)

 

Re: Norton 2011 released

Yep, he's a kid with a dream

MBAM found two files in temp folder, leftovers from Insight, would be found by Norton's full scan.
He just doesn't know yet that he needs to clean junk files before scanning with second opinion

 

Re: Norton 2011 released

Here's the new one from seasoned veteran languy99

-- http://www.youtube.com/watch?v=gevStvc52Bg --

 

Re: Norton 2011 released

checking out

 

Re: Norton 2011 released

Amazing. It blocks everything without the annoyance of HIPS or a sandbox. And low system impact on top of everything.

 

Re: Norton 2011 released

It's simply awesome

Intrusion prevention is great, in this video SafeWeb blocked access to cpl of sites, and languy wanted to enter that site anyway, but he couldn't because of Intrusion prevention which blocks that site for 30 minutes (default time) if attack from that IP was detected. There was alert for that in video but he ignored it for some reason.

IMO, all you need for protection is in this product, works very well, great design, very light, I love it !

 

Re: Norton 2011 released

I find it funny how he didn't realize that one of them urls he tested did work, but Norton blocked it from showing up.

mrizos is still king, at least he doesn't hurry this much and he explains some of the settings. And, most of them don't say that they are testing in a VM, some of the nastiest malware can realize it is locked in a VM like wild pets in a ZOO and it can get shy and not get out of its lair.

 

Re: Norton 2011 released

In my opinion, 2010 is little bit faster then 2011. I understand it when i can't exit full screen GOM player mode about 5 min (WinXP SP3, P-4 2.0 GHz, 768 Mb RAM).

And question: may i downgrade to 2010? Will it upgrade to 2011 automatically?

 

Re: Norton 2011 released

Just a question about Symantec 2011's products:
Do NIS 2011 and Endpoint Protection share the same components (Sonar 3, etc...) ?

 

Re: Norton 2011 released

No. Except from the company that creates them both and the same virus lab , they have nothing in common - completely different products.

 

Re: Norton 2011 released

Should we consider NIS is ahead (since SEP lacks Sonar or Insight) ?

 

Re: Norton 2011 released

I consider them two different animals. SEP for business use (and I have no control over that decision), NIS for home use (mine in partciluar).

 

Re: Norton 2011 released

NIS is considered better ss ur the decision maker and it always have latest engine than business product (though that get updated soon)

 

Re: Norton 2011 released

Some prior discussion on SEP vs NIS here: https://www.wilderssecurity.com/showthread.php?t=273818&highlight=norton endpoint

 

Re: Norton 2011 released

Thanks for this link.
NIS seems to be meant for proactivity while SEP is designed for administration and corporate policies.
Got my answer now.