[comp.virus] Review of Antivirus

p1@arkham.wimsey.bc.ca (Rob Slade) (03/09/91)

                               Comparison Review

Company and product:

Fink Enterprises
11 Glen Cameron Road, Unit 11
Thornhill, Ontario
L3T 4N3
416-764-5648
Telecopier: 416-764-5649
IRIS Antivirus

Summary:

Vaccine program with scanner.

Cost  $199 CDN, site licenses available

Rating (1-4, 1 = poor, 4 = very good)
      "Friendliness"
            Installation      3
            Ease of use       3
            Help systems      1
      Compatibility           3
      Company
            Stability         3
            Support           2
      Documentation           2
      Hardware required       3
      Performance             3
      Availability            2
      Local Support           ?

General Description:

The forerunner of Antivirus-Plus (reviewed earlier, cf PCANTIVP.RVW),
Antivirus makes no claims of artificial intelligence.  The program
structure is very similar.

For simple virus detection, Antivirus is recommended over Antivirus-
Plus.
                  Comparison of features and specifications

User Friendliness

Installation

The disk is shipped write protected.  The accompanying documentation is
very terse (less than one loose leaf sheet), but sufficient to install
and run the programs.  (The distributor has stated that he is increasing
the documentation, but is interested in keeping it short so as not to be
too intimidating.)  Further documentation is available on disk.

Installation can only be performed from the A: drive.  Installation is,
however, very simple, although the options that are available are not
explained.

Ease of use

Options for use of the CURE program (scanner/disinfection portion) are
available from the command line, but also from an onscreen menu if
invoked with no parameters.

Alerts to the presence of a virus are not clear as to which program or
disk is infected.

The problem in Antivirus-Plus of not being able to run certain programs
which amend or delete program files is not present in Antivirus.

Any access to a boot sector infected disk will trigger an alert.  The
infected disk is not identified, but attention to which disk is being
accessed will make this clear.  How a boot sector is identified as being
infected is not clear, but the behaviour of the program is indicative of
"scanning" type operation.  Therefore it is unlikely that "new" boot
sector viri will be detected.  However, there is some "change checking"
with regard to the boot sector.  How this is accomplished is not stated,
and it did give one false alarm (showing a changed boot sector on a
write protected disk.)

Help systems

None provided.

Compatibility

The program will detect and stop most common viri.  The problem in
Antivirus-Plus of not being able to run certain programs which amend or
delete program files is not present in Antivirus.

Company Stability

IRIS has been a small but consistent presence in the antiviral field.

Company Support

Little available.

Documentation

Documentation is brief but clear, although the information given deals
almost exclusively with installation.  Reasons for choosing various
options are not given.

Hardware Requirements

No special hardware required, but will only install from drive A:
(shipped on 5 1/4" media).

Performance

The program will detect most common viri.  The IMMUNE program will
detect and "eliminate" a virus within a program, but will usually be
able to allow the original program to run unhindered.

Boot sector infections are "detected" on each access to the disk.  When
the system is booted from a viral infected disk, the viral program will
become resident in memory.  At the invocation of the IMMUNE program, the
alert for an infected disk will appear.  (Interestingly, the IMMUNE
program will state that "!!No virus detected!!" on completion.)  Memory
scanners will still detect the virus resident in memory, but disks will
no longer be infected.  Disk editors are still able to write to the boot
sector.  (Note that this has only been checked with common boot viri.
Others may not yield the same behaviour.)

Local Support

None available.

Support Requirements

The program is simple enough that support should not be needed for most
instances.

                                 General Notes

The Antivirus program appears, in most respects, to be better behaved
than its Antivirus-Plus successor.

copyright Robert M. Slade 1991, PCANTIVR.RVW 910308


==============
Vancouver          p1@arkham.wimsey.bc.ca   | "It says 'Hit any
Institute for      Robert_Slade@mtsg.sfu.ca | key to continue.'
Research into      (SUZY) INtegrity         | I can't find the
User               Canada V7K 2G6           | 'Any' key on my
Security                                    | keyboard."