Posted By: Eugene Taylor

Ryan Naraine - eWEEKFri Nov 3, 11:24 AM ET

Among existing desktop security software, Symantec's Norton AntiVirus 2007 suite is the best at detecting and removing stealth rootkits, according to a study done by Thompson Cyber Security Labs.

ADVERTISEMENT

if (window.yzq_a == null) document.write("");if (window.yzq_a)
{
yzq_a('p', 'P=OEGyDkLaS.Zl5eR1c3BYswBrSDRIwkVMFq4ADANA&T=17vdc497q%2fX%3d1162614446%2fE%3d7666520%2fR%3dnews%2fK%3d5%2fV%3d1.1%2fW%3d8%2fY%3dYAHOO%2fF%3d1625245718%2fH%3dY2FjaGVoaW50PSJuZXdzIiBjb250ZW50PSJzZWN1cml0eTtTZWN1cml0eTthbnRpLXZpcnVzO01pY3Jvc29mdDtpdDtJbnRlcm5ldDsiIHJlZnVybD0iIiB0b3BpY3M9IiI-%2fS%3d1%2fJ%3d88A949D1');
yzq_a('a', '&U=13an3t0mp%2fN%3dYoAfAkLaX.c-%2fC%3d555469.9388392.10231630.2498248%2fD%3dLREC%2fB%3d4063631');
}

In the study, which was commissioned by Symantec and conducted by veteran anti-virus expert Roger Thompson, 20 randomly chosen pieces of rootkit-laden malware files were pitted against the major anti-virus and anti-spyware vendors to rate detection and removal capabilities.

In both categories, Symantec's Norton came out tops, although the tool did not fully remove all 20 rootkits.

The application that performed the poorest, according to Thompson, was Microsoft's Microsoft Windows Defender (Beta 2), which is being built into the Windows Vista operating system.

In the detection category, Thompson tested the software's ability to find the presence of a rootkit after it is installed on a computer. If a particular rootkit is not detected, it could be due to either engine limitations or missing detections for a particular version of the rootkit, according to the report released by Symantec on Nov. 3, here in PFD form.

The software suites were rated separately on remediation capabilities, which tested the ability of the product to remove the components so that the rootkit is no longer left running on the system, as well as the ability of the product to completely remove the side effects of a rootkit, including registry keys.

In the detection category, Symantec Norton scored the highest, followed by McAfee Internet Security 2006, Webroot SpySweeper, F-Secure Internet Security Suite 2006 and Sunbelt CounterSpy.

Microsoft's Windows Defender only detected five of the 20 rootkits.

In the clean-up category, Symantec also scored the highest, well ahead of Webroot, F-Secure, McAfee, Sunbelt and Microsoft.

However, affording to Thompson's findings, most of the security tools did not fully remove more than half of the rootkits. Sunbelt, Microsoft and Trend Micro deleted only five of the 20 rootkits.

Check out eWEEK.com's Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer's Weblog.

The information reported above is property of Yahoo! inc. and reprinted or modified with legitimate permission.