Independent Research Shows Network Associates' Customers Are At Risk From Potential Virus Infection

Secure Computing research reveals Norton AntiVirus repair rates are superior to Dr. Solomon's, Network Associates, Trend Micro and Sophos

CUPERTINO, Calif. - March 8, 1999 - Research conducted by Secure Computing, one of the world's leading anti-virus certification authorities, has revealed that thousands of European corporate organizations are at risk from virus infection.

The research shows that users of Dr. Solomon's AntiVirus Toolkit version 7.93 are at risk of infection from eight in-the-wild viruses, including two strains of the CIH Windows virus. Secure Computing found that Norton AntiVirus 5.0 is able to detect and repair 100 percent* of in-the-wild viruses, while Network Associates' VirusScan 4.0.2 and update 4015 is unable repair the Natas boot sector virus and incapable of properly disinfecting a common macro virus. Trend OfficeScan failed to repair two viruses and was unable to completely repair a further six.

The research was conducted by technicians at Secure Computing's labs in the UK on latest versions of products from the world's leading anti-virus vendors. The tests were run on Windows 98 against the Wildlist Organization's January 1999 list of 293 viruses to establish the products' ability to detect and repair in-the-wild viruses.

* Based on the Wildlist Organization's January 1999 list

Commenting on the research in a press release issued by West Coast Labs, the certification part of Secure Computing magazine, Paul Robinson, technical director, said: "It is obvious that users want to have their machines disinfected. To deny them this facility is at once frustrating for the user and an abnegation of the developer's responsibility to 'solve' the problem. What is worse is where developers claim they solve the problem and then don't."

He continues: "There is now little differentiation between the leading products in terms of their ability to detect viruses. For all users, but particularly corporate organizations, detecting a virus is of little value if the anti-virus software they are using is incapable of disinfection also. Vendors should be striving towards providing complete protection - detection and disinfection."

Since the company was acquired by Network Associates last year, the majority of former Dr. Solomon's customers, an estimated 10,000 companies worldwide, still use AntiVirus Toolkit 7.0, Dr. Solomon's flagship product, having been assured by Network Associates that the product would continue to be supported and developed until April 2000.

"It doesn't surprise us that the Secure Computing research shows the Dr. Solomon's engine is unable to repair so many viruses," says Enrique Salem, vice president of Symantec's Security and Assistance Business Unit. "We are hearing from a number of Dr. Solomon's users that have experienced virus outbreaks. In many instances we are finding that Dr. Solomon's AntiVirus Toolkit is detecting viruses but not repairing them. When Norton AntiVirus is deployed it finds and repairs the problem virus and often finds and eradicates other viruses as well."

Since Network Associates' acquisition of Dr. Solomon's, Symantec has increased its share of the European retail anti-virus market to greater than 50 percent in the key markets of the UK, France and Germany. Symantec attributes the growth to former Dr. Solomon's customers switching to Norton AntiVirus.

1998 was a period of intense anti-virus market change with key players announcing a number of acquisitions and major alliances. As a result of the changing market landscape, 1999 promises to be a year in which almost every organization in Europe will be faced with having to transition to a new anti-virus standard.

A recent white paper produced by the META Group entitled Anti-Virus: Time to Review, stated in the section called "24 months of Consolidation and Forced Change": "Organisations should not automatically consider falling into the "gravity well" of migrating to a particular vendor because that vendor now owns the technology currently installed."

The META Group white paper continues: "A critical factor in the [corporate end user's] selection process should be a vendor's migration or deployment capability. Most migrations will require a deinstallation of the existing product followed by a reinstallation of the new product_.Indeed, we believe the requirement for product migration presents a prime opportunity for organizations to start fresh and select a top tier vendor that will meet their specific requirements."

Symantec has gained commitments from more than 4,000 companies representing over two million seats worldwide to transition to Norton AntiVirus and has developed services to deliver a smooth transition for customers. The service combines tools, such as unobtrusive uninstall/reinstall utilities, with on-site training and assistance from transition consultants.

About Checkmark
The Checkmark provides a clear and unambiguous indication of attainment of a relevant standard for users of computer security solutions. The Checkmark consists of a standard, a test and a certificate. The standard is a real-world, industry accepted test. The test may be carried out by West Coast Labs or by an accredited tester. The certificate is awarded by West Coast Labs. Several Checkmarks exist currently (or are imminent)

• Anti-virus Checkmark
• Trojan Checkmark
• Firewall Checkmark
• Year 2000 Checkmark
• UPS Checkmark
• VPN Checkmark

The Anti-Virus Checkmark, conducted by West Coast Labs, tests to see that the products can detect those viruses which are actually causing infections in the real world. This gives a clear and independent indication to end users that these anti-virus products can be relied on.

This testing procedure is repeated at least every three months and if a product fails to preserve its level of detection, its Checkmark is suspended and even withdrawn if the manufacturer does not improve the product's detection. This means that users can rely on Checkmarked products since the manufacturers are making a serious commitment to the quality of their products that is being independently verified by West Coast Labs.

Users can easily verify that a product has a Checkmark by looking at the product box to see if it carries the Checkmark logo, by contacting West Coast Labs, or by visiting the Checkmark web site.

The Checkmark is the dominant global standard of effectiveness of computer security products. Secure Computing Research - interim results.

100% Disinfection

1. Norton AntiVirus 5.01.01 with update 3/1/99 All items successfully disinfected
2. Command AntiVirus 4.54 with update 3/3/99 All items successfully disinfected
3. InoculateIT 5.00 + update 4.18 All items successfully disinfected

Partial or incomplete Disinfection

1. Dr Solomon's AVTK Version 7.93

No disinfection for:

• W97M.Class.D
• Tentacle.10634
• W97M.Class.Q
• W95.E1 Inca
• W97M.Coldape.A

Incomplete disinfection of

• Natas (boot sector)
• W95.CIH.1.4
• W95.CIH.1.2

2. McAfee VirusScan 4.0.2 + update 4015

No disinfection for:

• Natas (boot sector)

Incomplete disinfection of

• W95.El Inca

3. Norman Virus Control Version 4.64

No disinfection for:

• 11 file viruses
• 5 macro viruses
• All boot sector viruses

4. Trend OfficeScan 3.11b + update 507

No disinfection for:

• W97M.Brenda.A
• W97M.Class.Q

Incomplete disinfection for:

• WM.Copycap.A
• Nilz
• Quicky.1376
• W95.El Inca
• Stoned.Azusa
• Stoned.Standard.B

• No file virus disinfection available.

No or incomplete disinfection for:

• 20 boot sector viruses.

Tests run on Windows 98 against the January 1999 Wildlist Organisation's virus list.

Results shown here are interim, further tests are being conducted and final results and analysis will be published at the InfoSec World conference in Orlando, Florida.

*Secure Computing Magazine is not in any way associated with Secure Computing Corporation.

About Symantec
Symantec is the world leader in utility software for business and personal computing. Symantec products and solutions help make users productive and keep their computers safe and reliable anywhere and anytime. Symantec offers a broad range of solutions and is acclaimed as a leader in both customer satisfaction and product brand recognition. Symantec is traded on Nasdaq under the symbol SYMC. More information on the company and its products can be obtained at www.symantec.com.

NOTE TO EDITORS: If you would like additional information on Symantec Corporation and its products, view the Symantec Press Center at www.symantec.com/PressCenter/ on Symantec's Website.

Brands and products referenced herein are the trademarks or registered trademarks of their respective holders. All prices noted are in US dollars and are valid only in the United States.