Symantec's Norton Internet Security 2008 suite offers solid security protection and features, including the best behavior-based defense against unknown threats.

Symantec's Norton Internet Security 2008 security suite ($70 for up to three PCs) is easy to use and comes with a host of extra security features, such as a separate Security Inspector scan that warns about unsafe browser settings and other potential security holes. It was the only suite in our testing for "All-in-One Security Suites: Tried and Tested" that didn't cry wolf by reporting at least one false positive.

It detected an above-average 91 percent of AV-Test.org's 674,589 malware samples. This results put the Norton suite close behind the Avira Premium Security Suite, BitDefender Internet Security 2008, Checkpoint ZoneAlarm Internet SecuritySuite 7.1, and Kaspersky Internet Security 7.0 packages, each of which detected 95 percent or more of the malware samples. Nevertheless. a 4 percent difference in detection rates represents a difference of 26,983 undetected samples. Symantec's suite produced the second-worst showing on AV-Test's heuristic tests, catching only 10 percent of samples when required to use one-month-old signature files to detect unknown malware based on similarities to existing code.

The Symantec suite did outperform the other programs at getting rid of infections. It cleaned up 80 percent of all files and Registry entries added by malware. In particular, Norton was a champ at fighting rootkits--malware designed to hide other malware. It detected every active and inactive rootkit sample, and successfully neutralized those infections. Symantec's suite was one of only two programs (Checkpoint was the other) to detect and block unidentified malware based solely on the way it behaved, but even so it caught just one sample out of five.

In our tests, on-demand (user-initiated) scans were more than 50 percent faster with Norton than with the next-fastest suite (Avira Premium), yielding an impressive data-analysis rate of 16.07 megabytes per second. And those on-demand scans look inside file archives, where crooks frequently hide malicious payloads. (On the other hand, Norton's automatic scans, which check files as your system saves them to the hard drive, won't check file archives unless you change the default settings).

Symantec's firewall is polished. It successfully blocked attempts from outside to scan a protected PC for information, and it did better than most competing suites at refraining from issuing unnecessary warnings about benign apps such as Firefox and Internet Explorer.

In addition, Norton Internet Security displayed an apt warning when it detected an unencrypted wireless connection, and it incorporates various safe-browsing features. For example, its Norton Confidential toolbar, designed for Firefox and Internet Explorer, blocks phishing sites; and its Browser Defender checks for known vulnerabilities in Internet Explorer 6 and 7. Though the suite's Identity Safe feature protects sensitive data, such as credit card numbers, from inadvertently leaving your PC, you'll must manually tell it what information to protect--a standard but laborious process. It has no antispam or parental controls, but those features are freely downloadable from Symantec's site.

The interface is well laid-out, and the software's pop-up detection alerts are generally understandable, though they provide little information, such as where a threat was found. Its impressive log entries simplify the task of finding out what the program has been up to--but again they lack information about where a given threat was discovered.

Our one major criticism of the suite is that when we uninstalled it, it left behind the separate LiveUpdate component. You have to know to go back and remove LiveUpdate as well.