EScan antivirus 10 is a new type of antivirus that works in the WinSock area of Windows. WinSock is the way that software (e.g. a browser) hook up to TCP/IP (computer communication standard) to send information to Google or download a program. Since eScan operates at such a low level on the computer, all internet traffic and network activity (Skype, ICQ, updates) are checked for viruses and malware. This technology is similar to the security used on corporate networks via packet inspection. EScan also utilizes a variant of Kaspersky’s engine for even more application protection. To top the cake, the software even includes a firewall, which is surprising considering it is advertised as a standard antivirus. Does WinSock integration improve antivirus performance compared to standard application protection?
Installation:
The installation executable was 97 megabytes in size, which is moderate compared to other free antivirus. In general, the installation was pretty smooth and did not require a system restart. There was an initial virus scan but the virus definitions didn’t update before the scan started. I felt that the scan was very informative in that it showed exactly the locations it was scanning and the antivirus recipe (what specifically the scan was looking for). The quick scan also completed within 5 minutes.
One thing that I like about the installation was that it was highly automated. At every point, the user is completely aware of everything that the installer is doing. The automation theme is also repeated throughout every function of eScan. Finally, the program launched immediately after the installation and didn’t require a restart even though a firewall was installed.
Interface:
The antivirus interface didn’t really have any standout graphics. The manufacturer of the eScan is MicroWorld and they are a company based out of India. Escan’s and Quickheal’s interface have a lot in common in terms of icons used and the font settings. On that note, eScan doesn’t really have any stand out features. A few problems are that the Update Time is probably synced to another time zone about 8 hours ahead of the Windows Clock. I also don’t like when a menu item is selected, as there isn’t any way of indicating that an item is selected. Finally, on the antivirus status page, it is somewhat hard to know the status of the antivirus engines; there is just a small x or check mark. There is also a problem with the firewall configuration in that it does not correctly identify the network adapters.
However, I do like a couple of things. On the firewall status page a user can easily change how the firewall functions. In addition to allow all and block all, there are the limited mode (applies to incoming as per firewall rules) and the interactive mode (applies to the ingoing and outgoing traffic).
Features:
As stated above, eScan really does provide many unique options compared to other free antivirus.
Firewall. This is again a surprise inclusion in “regular” antivirus software. However, the firewall really only provides basic protection and is fairly difficult to configure. The first option is a zone rule. Unfortunately, unlike other internet security programs the zone rule does not configure for a network adapter rather it configures for host names, IP address, or IP ranges. The next setting is the expert rule area, which does allow configuration for a specific adapter. Unfortunately, the firewall states “any interface” rather than displaying the two common interfaces on the test computer (dell wireless and Realtek LAN). However, I do like the advanced ICMP traffic treatment, which can be abused by hackers. The final two settings are the Application Rule, Trusted MAC address, and Local IP list. The Application Rule gives an executable either permit or deny. The Trusted Mac and Local IP List kind of collude but still ensure that only trusted devices / computers connect to the target computer.
Remote Support. This is the first time that I have seen this in free antivirus software. The remote support feature is built into the eScan software and allows a technician to remotely connect to the software without any complex configuration. An eScan technician can diagnose any problem with viruses or the antivirus software itself. This really is an advantage to the software and can be achieved because the company is smaller than Norton or MacAfee. Users can therefore be assured that their virus problem can be resolved even if the antivirus software falls short.
Anti-Spam. EScan has excellent antispam functionality. In addition, to extensive on board protection through NILP and SPF the antispam also includes capability to add RBL servers and Anti-spam whitelists. By default, the RBL lists already include spamhaus.org and spamcop.net while the whitelist includes a Google white list among others. The antispam protection isn’t as advanced as AVG Internet Security’s but still provides excellent default protection out of the box.
Various System Tools. To complement the remote support features, eScan includes a TCP connection viewer, system information, and debug information. All of these tools will be extremely useful in diagnosing a problem with the antivirus or a virus.
Helpful Instructions. Escan Antivirus 10’s instructions are organized into an online wiki, which makes finding an explanation about any feature extremely easy
Virus Scanning and Detection:
As stated in the introduction, eScan takes a new angle in virus detection in that it works in the WinSock layer providing a kind of proactive detection. I found that this technology worked as advertised. For example, when downloading the Eicar test virus, the virus did not even need to be completely downloaded before the virus was detected. In fact, Firefox was not even able to assemble the file into an executable before the virus was deleted (the .part file was deleted). As a result, Firefox displayed a failed download as if the connection was disconnected before the download was completed. When using Bitorrent, a clear virus torrent does not even need to finish before it is detected and deleted (utorrent will then display an error message). Basically, this proactive detection and disinfection is truly an innovative feature in a consumer product.
A full system scan completed in about 2 hours and 30 minutes, which is on the long side for a virus scan. On the test system, zero viruses and zero false positives were detected. According to av-comparatives, eScan exhibits excellent capability at detecting adware/spyware and has won a gold award for malware removal. I tend to agree with these ratings, as eScan is extremely efficient at deleting a virus regardless of any program currently accessing the virus. Essentially, a user will not run into an access denied messages.
Resource Usage:
Escan has extremely conservative resource management. During a virus scan, the CPU will not exceed 15% usage. The memory burden is even more amazing. Escan will only utilize 27 megabytes of resources even during an active virus scan. This is a truly amazing figure and makes eScan the most efficient, tightly coded antivirus tested. I think it is truly ironic given that the scan provides the option to move the scan to the background even though it is unnecessary. It might be a good idea for eScan to increase resource usage to decrease the scanning time.
Conclusion:
In conclusion eScan Antivirus 10 includes an innovate antivirus technology not found in other consumer antivirus products. Usually anything “innovative” suffers from being first to market or being presented as a marketing gimmick. However, eScan is excellent at detecting network viruses and should be installed on computers that have heavy network activity. However, no one lives in a perfect world and eScan still suffers from a lackluster interface and long scan times. Regardless, eScan has a lot of potential and will definitely be improved in the future.
- eScan Antivirus 10 Download here
- eScan Free Edition Download here
