ZoneAlarm has been the gold standard in free personal firewalls for many years. Budget-minded users combine it with a free antivirus to create an ad hoc security suite. With the release of ZoneAlarm Free Antivirus + Firewall (free), you can get antivirus and firewall protection in one free security suite, along with effective phishing protection and free online backup.

You won't find every feature in this suite, but not everyone needs spam filtering, parental control, or the raft of security extras that some suite vendors pack in.

Effective Firewall
Naturally this product's firewall protection is exactly the same as that of ZoneAlarm Free Firewall 2012 (free, 4.5 stars). Check Point will continue to make the standalone firewall available for those who prefer a different antivirus. I'll summarize the firewall's features here; for full details please see the earlier review.

ZoneAlarm passed all port scan tests and other Web-based attack tests. It doesn't attempt to identify attacks on system vulnerabilities at the network level, but none of the exploits I tried managed to crack the test system's security. And as always I couldn't find any way to break down the firewall's protection programmatically, the way a targeted malicious program might do.

Early versions of ZoneAlarm effectively put the user in charge of controlling which programs can access the Internet. When a program tried to connect for the first time, the firewall asked the user whether to allow or deny it, this time or always. Modern firewalls, including ZoneAlarm, automatically configure permissions for known good programs identified through a huge online database. If it does confront you with a popup query, pay attention, as the program in question may well be a problem.

Advanced firewalls like those found in Norton Internet Security 2012 ($69.99 direct for three licenses, 4.5 stars) and Kaspersky Internet Security 2012 ($79.95 direct for three licenses, 3.5 stars) make security decisions about unknown programs based on their behavior. With these tools you'll never get a popup query.

Program control is of little use if a Trojan or other malware can gain access via a trusted program. ZoneAlarm is quite good at detecting sneaky techniques that try to work around normal program control.

Antivirus Lab Results
Checking the independent labs for ZoneAlarm results is a bit confusing. Virus Bulletin is the only lab that regularly tests ZoneAlarm. Even then, over the past four years ZoneAlarm has participated in just five VB100 tests and passed four of them.

Why this lack of love? Because the antivirus component in ZoneAlarm is licensed from another well-known security company, so most of the labs simply test the original. Check Point officially does not identify its antivirus partner, but you will find dozens of DLLs and other support files whose digital signature, copyright notice, and internal company name point to Kaspersky Lab. Coincidence? You decide.

The labs just love Kaspersky, giving it almost universally high marks. For a rundown on the major independent labs and their tests, see see How We Interpret Antivirus Lab Tests.

ZoneAlarm Free Antivirus + Firewall lab tests chart

Installation Ups and Downs
ZoneAlarm's installer gets right to business with a quick install option that configures all settings with default values. Do keep your eyes open; if you don't opt out you'll find that you've changed your browser's home page and default search to ZoneAlarm.

The installer runs a quick scan for active malware. If it finds threats, it runs a pre-install scan, reboots, and starts the installation again. That's a smart way to avoid having the installer derailed by malware. Half of my malware-infested test systems got this treatment.

Despite the pre-install scan, installation failed on three test systems. On advice from tech support I ran the Kaspersky Virus Removal Tool—there's Kaspersky popping up again! After KVRT one of the problem systems was fixed. For the other two, tech support recommended scanning with the Kaspersky Rescue Disk.

ZoneAlarm still wouldn't install after the rescue disk's cleanup. With a commercial product tech support would most likely have escalated the situation, perhaps arranging for a support agent to clean up the system using remote control. Since this is a free product, that wasn't an option. ZoneAlarm simply failed to install on two of twelve test systems.

Rocky Malware Removal
When ZoneAlarm's antivirus scan encounters a threat, it almost always treats the problem immediately. Occasionally it marked low-risk threats as "Action required," meaning I had to give permission to treat the threat. A few needed a reboot for full cleanup.

On more than half of the test systems ZoneAlarm kicked the cleanup process to the next level. A big popup window announced the need for advanced disinfection, with a warning not to use the computer during this process. In every case I let it perform the advanced disinfection and then, after the required reboot, launched a full scan. That turned out to be important, as the full scan frequently found items not removed by advanced disinfection.

One test system announced the need for advanced disinfection during the full scan, so I allowed it and started another full scan. Yet again it requested advanced disinfection. After going around four times I denied the advanced disinfection and let the full scan finish. I can't imagine this runaround would inspire confidence in the average user.

Overall ZoneAlarm detected 71 percent of the threats and scored 4.9 points for malware removal. Compared with scores from products tested under my previous malware collection that's very low. On the other hand, Kaspersky PURE 2.0 Total Security ($89.95 direct for three licenses, 4 stars), the only other product thus far tested with my new malware collection, detected 76 percent and scored 5.3, which isn't much higher.

Looking specifically at threats using rootkit technology, ZoneAlarm did well. It detected 100 percent of those threats and scored 8.2 for removal, much better than Kaspersky PURE's 60 percent and 5.6 points. Even though many products detected all rootkits in my previous malware collection, the average rootkit score for that group was just 5.6 points. For details on how I derive these scores, see How We Test Malware Removal.

ZoneAlarm Free Antivirus + Firewall malware removal chart

Impressive Malware Blocking
For my malware blocking test I attempt to install the same collection of malware samples on a clean test system. ZoneAlarm wiped out almost three quarters of the samples as soon as I opened the sample folder. It detected almost all of the rest during the install process, with a 95 percent detection rate overall. Its score of 9.3 points for malware blocking overall is definitely impressive, as is its perfect 10 of 10 points for rootkit blocking. The article How We Test Malware Blocking explains how I test and score antivirus products.

ZoneAlarm Free Antivirus + Firewall malware blocking chart

A few quirks mar this product's swing at perfection. When I attempted to download the same collection of threats, ZoneAlarm handled each download and either gave the program a safety rating or asked for permission to run an advanced analysis. That seemed like a good thing.

The problem is, in over half of the cases the download protection module disagreed with the on-access antivirus. Again and again I saw "Advanced Download Protection has determined this file is safe" while the antivirus identified the same file as malware. In one case, the regular download protection module displayed a big green "safe" notice for a file that on-access protection had wiped out on sight in the previous test. I don't have a lot of confidence in advanced download protection.

ZoneAlarm also includes behavior-based malware identification, but I never saw it kick in for any of my malware samples. On the other hand, when I tried to install 20 valid PCMag utilities ZoneAlarm flagged four as suspicious. Choosing to deny the suspicious action rendered three of the four unable to perform their function.

Powerful Phishing Protection
Phishing sites try to steal your passwords for bank websites and other sensitive sites. These frauds look just like the real site, and may even redirect you to the real site after you log in. Phishing is a cross-platform attack on the user, not the browser or the PC. ZoneAlarm's toolbar proved especially effective at identifying these sneaky sites.

Almost 70 percent of antiphishing tools I've tested recently are less effective than the SmartScreen filter built into Internet Explorer 8. Only Bitdefender Total Security 2012 ($79.95 direct for three licenses, 4 stars) has scored better than Norton in this test. The fact that ZoneAlarm's detection rate was just 10 percent below Norton's and 24 percent above IE's puts it in the elite group of winners. Note, too, that ZoneAlarm and IE working together would have been just 3 percentage points behind Norton. The article How We Test Antiphishing explains exactly how I derive these scores.

ZoneAlarm Free Antivirus + Firewall antiphishing chart

For another form of identity protection, ZoneAlarm offers a year of free credit monitoring through Identity Guard's "Good Start" program. Its toolbar also includes a simple button that launches your browser's version of private browsing. As with other ZoneAlarm products, your subscription entitles you to 5GB of hosted online backup powered by iDrive (free, 3.5 stars).

Boot Time Slowdown
This stripped-down suite had a lower-than-average impact in most of my performance tests. A script that fully loads 100 Web sites took just 6 percent longer under ZoneAlarm's protection than with no suite at all; the average among current suites is 23 percent. Another script that moves and copies a large collection of file between drives took 8 percent longer, while the average is 13 percent. And a script that zips and unzips the same collection of files ran 11 percent longer with ZoneAlarm watching, compared to the average of 17 percent.

I was surprised, then, to find that ZoneAlarm lengthened my test system's boot time by 60 percent, significantly more than any other current product. Results were consistent across 100 test runs. Boot time here refers to the time elapsed from the start of the boot process (as reported by Windows) until the system is ready for use. I define ready as meaning CPU usage is under 5 percent for 10 seconds in a row.

Most users spend a lot more time surfing the Web and working with files than rebooting the PC, so ZoneAlarm's impact won't make a big difference.

A Good, Free Choice
ZoneAlarm's free firewall has outlived many competitors. It's the gold standard for free personal firewall protection. The antivirus protection that takes ZoneAlarm Free Antivirus + Firewall into the security suite realm doesn't quite measure up to that standard. On the other hand, its phishing protection is among the best.

If you need a free security suite, this is definitely a good choice. Just be prepared for the possibility that you'll need additional help with initial installation on a malware-infested system. Comodo Internet Security Pro 2012 ($4.99/year direct, 4 stars) is another good choice, with better antivirus protection but a less-sophisticated firewall. Given that they're free, you can try both and make your own choice.

Sub-ratings:
Firewall:
Virus removal:
Virus blocking:
Performance:
Antispam: n/a
Privacy:
Parental Control: n/a

 

More Security suite reviews: