[comp.sys.mac.misc] Floppy virus scanner like SAM's?

hardin@dino.cad.mcc.com (John Hardin) (02/08/91)

I'm looking for an init that will scan (optionally) newly inserted
floppies for virus much like SAM's (Symantec's Antivirus package).  I
could just buy SAM, but it's about $70 and *all* I want out of the
package is the floppy scanner (is it the *only* thing in the package?
:-) and I'm *cheap*!  Does anyone know of a similar init that isn't so
pricey?

Thanks,
-jwh 
--
John Hardin, MCC CAD Program | ARPA: hardin@mcc.com | Phone: [512] 338-3535
Box 200195, Austin, TX 78720 | UUCP: ...!cs.utexas.edu!milano!cadillac!hardin

jln@casbah.acns.nwu.edu (John Norstad) (02/09/91)

In article <HARDIN.91Feb7171104@dino.cad.mcc.com> hardin@dino.cad.mcc.com 
(John Hardin) writes:

> I'm looking for an init that will scan (optionally) newly inserted
> floppies for virus much like SAM's (Symantec's Antivirus package).  I
> could just buy SAM, but it's about $70 and *all* I want out of the
> package is the floppy scanner (is it the *only* thing in the package?
> :-) and I'm *cheap*!  Does anyone know of a similar init that isn't so
> pricey?

Lot's of people think this a necessary feature for virus protection, but 
it isn't. 

I find automatic scans of newly inserted floppies incredibly intrusive and 
slow.  They drive me nuts.   I guess this makes novices feel all warm and 
safe, but it isn't necessary.

The main purpose of an anti-viral INIT is to detect and block all known 
viruses, notify you if any are detected, and completely prevent the 
viruses from spreading or causing any harm.

My Disinfectant INIT does just that, without doing any full scans of disks 
as they are inserted.  Instead, it catches each virus at it's initial 
point of attack.  It's tiny (< 6K), fast, completely unobtrusive, and it 
doesn't interfere with any installers, system software, or other programs. 
It does one thing and one thing only - it catches viruses.

Disinfectant is free, available from all good electronic sources for free 
and shareware Mac software.

John Norstad
Academic Computing and Network Services
Northwestern University
jln@casbah.acns.nwu.edu

keir@vms.macc.wisc.edu (Rick Keir, MACC) (02/09/91)

I just wanted to confirm 2 things John Norstad said, since he's
the author of Disinfectant and the suspicious might not believe
him.

(1)  Checking floppies is intrusive:  we have SAM here, and
     put it on a few public machines as an experiment.  The
     staff don't usually use these machines (they are demo
     and consulting units);  even so, the *staff* couldn't
     stand the constant hassle of the check.  I don't want
     to think about what our customers felt.

(2)  He claimed that his INIT doesn't interfere with anything
     else.  I think Disinfectant is the most compatible program
     I've ever had to work with, and I speak as one who, 5-6
     times a week, has a conversation that starts with "Try
     removing all INITs from your System Folder".

Disinfectant is great!  

carsup@extro.ucc.su.oz.au (Fisher Library support) (02/09/91)

In article <1991Feb8.213450.23668@macc.wisc.edu> keir@vms.macc.wisc.edu (Rick Keir, MACC) writes:
>I just wanted to confirm 2 things John Norstad said, since he's
>the author of Disinfectant and the suspicious might not believe
>him.
>
>(1)  Checking floppies is intrusive:  we have SAM here, and
>     put it on a few public machines as an experiment.  The
>     staff don't usually use these machines (they are demo
>     and consulting units);  even so, the *staff* couldn't
>     stand the constant hassle of the check.  I don't want
>     to think about what our customers felt.
>
>(2)  He claimed that his INIT doesn't interfere with anything
>     else.  I think Disinfectant is the most compatible program
>     I've ever had to work with, and I speak as one who, 5-6
>     times a week, has a conversation that starts with "Try
>     removing all INITs from your System Folder".
>
>Disinfectant is great!  

For some reason, I ended up with two legitimate copies of SAM. I sold one
and gave the other to a friend :)

Disinfectant is *THE* premier anti-viral util, although I am waiting eagerly
for Chris Johnson's Gatekeeper 2.0. On that note, I do also recommend his
Gatekeeper Aid INIT, which removes naughty viruses using the desktop file
as their ride.

My solution? Put both INITs into your System Folder: Disinfectant and GK Aid.
Don't leave home without it! :) Even John Norstad agrees the two are really
complementary (don't you, John?).

Norton

jln@casbah.acns.nwu.edu (John Norstad) (02/10/91)

In article <1991Feb9.054815.13710@metro.ucc.su.OZ.AU> 
carsup@extro.ucc.su.oz.au (Fisher Library support) writes:
> My solution? Put both INITs into your System Folder: Disinfectant and GK 
Aid.
> Don't leave home without it! :) Even John Norstad agrees the two are 
really
> complementary (don't you, John?).

Well, in general I recommend that people don't mix anti-viral INITs, with 
the exception of Gatekeeper and Gatekeeper Aid, which were designed to go 
together.  The reason is that it doesn't increase your protection very 
much, it causes confusion when one or the other INIT does indeed discover 
a virus, and it's just asking for trouble with INIT conflicts.

But I don't know of any conflicts between the various INITs, so this isn't 
a big deal - do what you want.

I don't think that there's a great advantage to using the Disinfectant 
INIT and Gatekeeper Aid together.  Yes, GK Aid will indeed eliminate 
desktop viruses and my INIT will only detect them, but rebuilding a floppy 
desktop only takes a second anyway.

The great advantage of SAM Intercept and Gatekeeper over the Disinfectant 
INIT is that they can and often do protect against unknown (new) viruses 
(not all, but some), while my INIT is GUARANTEED to fail to detect them.  
The advantage of my INIT is that it is tiny, unobtrusive, efficient, easy 
to install, doesn't require configuration, and doesn't require complicated 
decisions which novices don't understand.  This is an unavoidable 
tradeoff.  Each user has to decide for himself which type of protection he 
wants to use.  The most important thing is to use some kind of protection.

John Norstad
Academic Computing and Network Services
Northwestern University
jln@casbah.acns.nwu.edu

pj@pnet51.orb.mn.org (Paul Jacoby) (02/11/91)

John Norstad writes:
> I find automatic scans of newly inserted floppies incredibly
> intrusive and slow. They drive me nuts. I guess this makes novices
> feel all warm and safe, but it isn't necessary.

Bravo!  It is nice to see this coming from someone as well respected as Mr.
Norstad.  My work uses SAM on all it's machines, and it is the most annoying
bit of my day.... And that is disregarding the fact that it makes my boot-up
time almost three times longer than it should be....ack!

I use Disinfectant at home, but for some reason you can't convince some
corporate-types that a 'FREE' product is as good (or indeed BETTER) than
something they pay to license...

.-----------------------------------------------------------------------------.
| UUCP: {crash tcnet}!orbit!pnet51!pj            | RTFD = Read The Silly Doc! |
| INET: pj@pnet51.orb.mn.org                     |                            |
`-----------------------------------------------------------------------------'
 

ds4a@dalton.acc.Virginia.EDU (Dale Southard) (02/12/91)

First off,

I agree completely with everything John N. and others have said already.

BUT

If you really must have 1984-style scanning of inserted floppies, I believe
that the shareware program virus detective can autoscan.  I say believe
because, like others, I use a combination of the disinfectant init and
GateKeeper/GK Aid.  (By the way John -- using the two (three?) in combination
has one distinct advantage -- with the prevalance of .SEA files floating around,
I can have protection against known viri ALL the time and protection against
unknown viri most of the time -- and I have never seen a conflict between them,
nor seen any "bumping" when I looked w/ init scope)  It (Virus Det.) seems to
be well supported by the author, as he has the search strings for new viruses
out at about the same time as John has the next Disf. ready, both of which
seem to occur prior to any commercial defense release.

But your milage may vary...



-->  -->  Dale  UVa  (ds4a@virginia.edu)