[Chris Breen]

Mike, thanks very much for participating and making the effort to help out. I'm sure folks here appreciate it.

[webraider]

Quote

{quote:title=501user wrote:}
You're a teacher!

Quote

Do you speak to the children with such grace, charm, and politeness? They must love you.

Actually, My kids love me.

Quote

Please allow people not to use this product without abuse.

Okay.. However, I responded to Electrotech who implied that I was working for Symantec with his "Don't fall prey to these 'snake oil' salesmen!" statement. He's the one who was attacking me just because I've had a good exprience using their latest product. As is the case with The last link you gave me which was last updated in 2005, most people experienced some problems in an earlier version and haven't even tried the latest version which is usually the case. The latest version is the best version they've put out for sometime. Symantec has also been very good about issuing updates.

The first link you gave applies to windows users which has no bearing on the Mac so your argument there is Moot.

[mosley]

Yes, thank you Mike for taking the trouble and courage to enter this hornets nest! I don't use NAV but I appreciate the comments you made and for keeping yourself informed across the Mac user base.

[Penzi]

Yup - I used to be a Norton Anti-Virus user in my PC days (along with other products of theirs), throughout the 90's pretty much entirely (the AV stuff not the whole time, of course...) and I noticed that every single of my machines would run [much] slower once Norton AV was loaded on it. It was explained to me that in order for Symantec to be so much more effective at providing safety for my machines, they inveigled themselves into the OS, basically becoming a part of it... how true that is I cannot judge, but it slowed ALL of the machines I ever installed it on (and every version I ever used) and I just couldn't handle the performance hit, so I gave up on it...

[bastion]

webraider said:

That's too bad. Norton Antivirus for Mac version 11 Works very well. ... It does what it's supposed to never had a virus or a problem.

I have a rock in my front yard that's equally good at keeping away T. Rexes.

[mikeromo]

Good morning, guys--
(thanks for the notes, by the way--I am glad to do what I can to help)

So, yes--we do install kernel extensions--we have to do it to do what we do (scan before things get written to disk, run operations at root so scans can happen, etc, retc)...but again, I am just curious as to what the slow downs you're seeing are. I have more slow downs with the "mds" process rocking my machine from time to time. Regardless, what you are saying about Mac threats is true--there are not that many (but to say none is just wrong--we had that multiplatform piece of malware posing as an image viewer not so long ago, and there was another low level virus that we added a def for just two weeks ago, and don't forget the annoying macro viruses that are still out there that can result in your attachments getting bounced back -- my friend had 300 files infected with macro viruses and could not send any word documents) and while the threats are few and far between, some people and many organizations prefer (if not require) some kind of virus protection. (Heck, try ClamAV or iAntiVirus--those are free soluions that might work for you.) The most recent version of our product blocks against vulnerability exploits, as well--again, there are not a ton of these, either, but just because there are not that many threats, amd I really not supposed to do anything about them?

But if this protection is mashing up your machine, then it's doing much more harm than good--no one will argue that. That's why I am realy curious to find out what these bad experiences are. Norton AntiVirus, out of the box, should not be slowing down your system. If you are running a full system scan in the middle of your work day, maybe do it later--but any full system scan of any type (including spotlight and time machine) is going to slow down your machine. We have added code in AutoProtect that is designed to make sure we are not intefering with other applications when writing files to disk (product like Photoshop, which write and delete lots of data was one example of us having to change AutoProtect so we were not in the way). Of course, it's easy for me to say, "Well, it doesn't do that on my machine," but that's my experience. If it is not yours, or you know someone who is having specific problems and you know, by looking in Activity Monitor, that Norton is using an inordinate amount of your CPU, please--please--email me at mike_romo@symantec.com.

Thanks, have a good day, I'll keep buzzing by this board to check in!

best,

mike

mike_romo@symantec.com

[bastion]

mikeromo said:

First thing's first: we scan inside archives by default. This can take awhile because we have open up the archive, scan the contents, then re-archive the file.

You what?

That's nuts. Why would you rearchive the data rather than just keep the archive around?

[mikeromo]

I guess I wasn't clear. Here's what we do:


1 - We run scan.

2 - When we see a .zip file on the user's machine, or a .tar or whatever, we UNZIP the file, examine the contents for virues, then REZIP the file, since the user had it as a zip file in the first place. I don't think anyone would appreciate it if we opened up all the archived files and just left them open. So, in a way, we are keeping the archive around.

And, like I said, this can take more time and that's why we give you the option to turn it off.



sorry if I wasn't clear.



-mike

mike_romo@symantec.com

[dougster]

Hi -Mike,

Thanks for taking the time to clear up some things about NAV running along side OSX. Symantec use to come out every year at our MUG at Orange Coast College, Costa Mesa, CA. Yes, I've helped to pay your salary. B-)

Thanks again...

[Grapho]

I think what he meant was that why not copy the archive, scan it and then delete the unzipped version. Would this not be faster?

[mikeromo]

Thanks for that note, Doug!

[mikeromo]

Depends on how large the archive is, right? Adding a copy to this process, then opening the archive, then scanning the contents, then deleting the contents, then deleting the copied archive..it sounds like more of a hassle than it's worth. I will talk to the architect to see if I can get more granularity for this.

But I can imagine us getting criticism for spending extra cycles copying and deleting files...



But honestly--performance is something we are always pounding on. With scanning speeds, sometimes are limited just by the speed of the disk. We are totally rethinking the way we do scanning on the Windows side and I think it's okay for me to tell you that we are looking into different ways of doing this as well. It was one thing when drives were 80GB, but now that you can get 500GB drives...it can just take awhile and I want to do it better.

Thanks for your feedback, it means a lot to me personally that you are giving me a chance to discuss this stuff with you.

-mike

mike_romo@symantec,com

[Grapho]

[quote name='mikeromo']

Depends on how large the archive is, right? Adding a copy to this process, then opening the archive, then scanning the contents, then deleting the contents, then deleting the copied archive..it sounds like more of a hassle than it's worth. I will talk to the architect to see if I can get more granularity for this.


But I can imagine us getting criticism for spending extra cycles copying and deleting files...





But honestly--performance is something we are always pounding on. With scanning speeds, sometimes are limited just by the speed of the disk. We are totally rethinking the way we do scanning on the Windows side and I think it's okay for me to tell you that we are looking into different ways of doing this as well. It was one thing when drives were 80GB, but now that you can get 500GB drives...it can just take awhile and I want to do it better.


Thanks for your feedback, it means a lot to me personally that you are giving me a chance to discuss this stuff with you.


-mike


mike_romo@symantec,com

mikeromo said:

But I can imagine us getting criticism for spending extra cycles copying and deleting files...

I think you guys are in a tough business. The need of AV software on the Mac is questionable, although you do bring some good points as to why it even exists. So if it's not inherently necessary at this point, why even bother. This how I see it today. These circumstances can change off course, but I will hold out for now.

I will say this, it is incredibly refreshing to actually have a representative of a software company make him self available for this one on one discussion. I wish other companies would do this. Thanks for your polite and professional feedback.

[jdb8167]

Grapho said:

I think you guys are in a tough business. The need of AV software on the Mac is questionable, although you do bring some good points as to why it even exists. So if it's not inherently necessary at this point, why even bother. This how I see it today. These circumstances can change off course, but I will hold out for now.

While I wouldn't recommend that someone install AV software on their Mac right now, the problem is that if companies like Symantec stop developing their AV software and it ever becomes needed, it won't be available. It can take months to years to develop even simple software. And AV software is decidedly not simple.

So, it is good that at least some Mac users are required to run AV software because without those users, companies like Symantec would just give up their development as not profitable.

It is good to see a technical person from Symantec taking an interest in this kind of public forum.