By Rob Pegoraro
Sunday, November 5, 2006

Security software doesn't exactly top most people's wish lists. You know you need it -- how else will you protect Windows against viruses, spyware, trojans and whatever other creepy stuff the Internet throws at you? But there's no joy attached to using these defensive programs.

That's somewhat unavoidable with software that, by nature, has zero productivity or entertainment value. Anti-virus, anti-spyware and firewall applications can only help your computer if it's already infected; otherwise, the best they can do is keep your PC in the same condition.

And in the meantime, you have three or more separate programs to maintain. Combining those applications into a unified whole should at least minimize the nuisance factor and, ideally, give your computer a software bodyguard who looks out for trouble at all times.

But a tryout of new security suites from five major developers -- CA, McAfee, Panda, Symantec and Trend Micro -- revealed many of the same sins all around. (Two other developers, Microsoft and Zone Labs, are between updates.) Too often, the software meant to keep your computer safe does so at an unnecessary cost.

Stability: All of these packages must interact with the deepest innards of Windows, and having two of them active risks severe conflicts. But Symantec's Norton Internet Security 2007 (Win XP, $70) didn't even warn me about the presence of an older security suite on the test computer.

McAfee Internet Security Suite 2007 (Win 2000 or newer, $70), Panda Internet Security 2007 (Win 98 or newer, $70) and Trend Micro PC-cillin Internet Security 2007 (Win 2000 or newer, $50) did issue that heads-up, but left it to the user to clean out the other security programs.

Only CA Internet Security Suite 2007 (Win 98 SE or newer, $70) extracted the old software automatically.

Efficiency: These suites can eat up a huge chunk of your computer's capacity, greatly prolonging its start-up times and cutting into memory available for other programs. Norton Internet Security seemed the worst offender, but the others did not appear to be much better.

Visual clutter can also be a problem with these programs, in the form of the toolbars and buttons some add to your Windows desktop, Web browser and e-mail program. CA, Panda and PC-cillin, however, were less of a bother in this respect.

Consistency: Although each of these suites presents a unified front, their constituent programs can have trouble coordinating their work. For example, PC-cillin's anti-spyware component warned me when I visited a site offering spyware downloads but didn't stop me from running a screensaver obtained from there. CA's suite was the least integrated of them all: While the other packages' control panels provided a simple "scan now" button to check for trouble, CA lacked that.

Education: A good security package should educate as well as protect, so you can develop your own sense of what's safe and what's not.

PC-cillin was the worst of the batch at this. When it erased some viruses, my only notice was a vague Windows error message. After a new program set itself to run automatically at each start-up, a "Suspicious changes detected" dialogue effectively buried any useful information about the nature of that potential threat.

McAfee and CA, on the other hand, unmistakably flagged viruses the instant I tried to do anything with them: There was no mistaking when these programs brought down the hammer.

The firewalls in these packages, in policing which programs can connect to the Internet, often failed to offer any clue as to whether a new application should be trusted. That forces users to guess which ones are safe -- and if they could do that correctly on their own, they wouldn't need security software in the first place. Norton's firewall provided the most consistently useful guidance.

Effectiveness: Whatever else it does, a security package shouldn't ever put your computer at risk of infection. But in a few rare cases, these suites missed some things they shouldn't have: Panda didn't catch two of four viruses. McAfee's generally helpful SiteAdvisor, intended to warn users about malicious Web pages, suggested that a site distributing pirated game software would be fine to visit (somehow I doubt that).

Cost: The list prices of these bundles cover a year's worth of updates, at which point you need to ante up most or all of the purchase price to renew your subscription. If you own more than one computer, note that McAfee is only licensed for use on a single PC; the others allow installation on three.

If you must use one of these suites, McAfee edges out the others. But none of them makes a convincing argument against mixing and matching separate security programs.

For example, you could combine the free firewall built into Windows XP with Microsoft's free Windows Defender anti-spyware utility, then keep whatever anti-virus program came with your PC (or download the free AVG software: http://free.grisoft.com/ ). To block phishing Web sites trying to impersonate your bank, try the new Internet Explorer 7 and Mozilla Firefox 2.0 browsers.

Whatever security solution you pick, don't forget to use the single most effective defense available: a healthy sense of skepticism when it comes to running any kind of strange software.

Living with technology, or trying to? E-mail Rob Pegoraro atrobp@washpost.com.