Why comment about Symantec, Kaspersky, other....with NortonLifeLock Community.
Norton offers specialized protection that helps in keeping you and your devices safe. Your PC is protected from viruses, online threats, identity theft and financial scams.
-
Total Cloud Protection - a feature that scans your PC directly using cloud-based virus definitions.
-
Static Data Scanner (SDS) - These user-mode modules enable an enhanced security model, improved protection efficacy, and better resource management.
https://support.norton.com/sp/en/us/norton-security/current/solutions/v111382660 - 2020
Introducing Symantec Data Scanner (SDS) Technology
Norton Security provides its protection in two modes: kernel and user modes (more info).
In kernel mode, Norton Security provides real-time protection by monitoring the activities of all running processes; and performs various security checks on calls made by applications running in user mode. Our antivirus engine running in kernel mode ensures that malicious codes are not making unauthorized modifications to the key areas of OS and user environment. This ensures threats like rootkits are blocked; and infected files are not getting onto the system. In user mode, Norton Security performs the analysis of memory access and ensures safe execution of applications running in the system. The protection in user mode prevents advanced threats from executing malicious CPU instructions and making memory modifications.
Norton Security PC client v22.7 introduces our next generation antivirus engine featuring Symantec Data Scanner (SDS) technology as well as a newly architected real-time protection system (Auto-Protect). SDS is a user mode only solution targeting modern platforms and products. With the introduction of SDS all file scans will execute in user mode, providing improved security and better resource management. Beyond improved security, SDS also delivers refined detection technology that enables our Response Ops team to detect threats sooner.
The new engine can monitor the activities of processes and file IOs in kernel mode and scan in user mode without trading off performance of the system. Scanning in user mode provides additional flexibility by removing memory limitations in kernel mode. This also supports other enhancements included in this release such as our enhanced emulator. Moreover, it allows flexibility to develop features that are not possible to do in kernel. Furthermore, SDS can expand the security checkpoints in-memory access by malicious processes and perform more sophisticated repairs under certain conditions.
https://community.norton.com/en/blogs/product-update-announcements/introducing-symantec-data-scanner-sds-technology - 2016
Auto-Protect is the first line of defense against threats by providing real-time protection for your computer. Whenever you access, copy, save, move, open or close a file, Auto-Protect scans the file to ensure that a threat has not attached itself. By default, it loads when you start your computer to guard against threats and security risks. It also monitors your computer for any activity that might indicate the presence of a threat or security risk. Auto-Protect can determine a file's type even when a threat changes the file's extension.
When a threat, threat-like activity (an event that could be the work of a threat), or a security risk is detected, Auto-Protect alerts and takes the necessary steps to either clean, quarantine, delete or leave alone (log only) the detection of a threat depending upon the actions configured for each detection type.
Whenever you access, copy, save, move, open, or close a file, Auto-Protect scans it to ensure that a threat or security risk is not present.
A Full System Scan will detect viruses and security risks by examining all files and processes (or a subset of files and processes). A Full System Scan can also scan memory and load points. (Note, though, that no AV product can detect threats which exist only in memory and are not written to the disk.)
Note: Auto-Protect does not scan inside compressed files due to the amount of time required to uncompress the container file and scan each file. A Full System Scan will scan inside compressed files.