NetNews Usenet Archive 1992 #19/NN_1992_19.iso/spool/comp/sys/ibm/pc/misc/12024

Internet Message Format | 1992-08-29 | 5.8 KB

Xref: sparky comp.sys.ibm.pc.misc:12024 comp.os.msdos.apps:4564 comp.binaries.ibm.pc.d:3390
Path: sparky!uunet!zaphod.mps.ohio-state.edu!news.acns.nwu.edu!nucsrl!ddsw1!infopls!bleys
From: [e-mail] (Bleys Ahrens)
Newsgroups: comp.sys.ibm.pc.misc,comp.os.msdos.apps,comp.binaries.ibm.pc.d
Subject: Re: What is the best anti-virus program???
Message-ID: <[e-mail]>
Date: Fri, 28 Aug 92 22:17:49 CDT
References: <[e-mail]>
Organization: INFOPLUS support, Wheeling, IL
Lines: 98

All Anti-Virus programs are not created equal.

Most anti-virus packages on the market today  (Norton, Central Point,
Untouchable, MacAffee) rely on pattern scanning as their primary method
of detecting a virus.  In other words, they have a database of some sort
containing hundreds of strings or attributes that known viruses produce
when they infect a computer.  This has worked relatively well in the
past, but unfortunately it is rapidly becoming unpractical.  When new
viruses and strains are identified, the appropriate patterns must be
added to the databases of pattern scanning programs.  This may be done
with updates to the program on disk, via download or manually typing
strings into the database.

The problem is that an average of three new viruses are being created
everyday.  Add to this, the number of new mutating viruses which change
their appearance and method of operation as they spread and it quickly
becomes impossible to keep up with the spread of viruses.  As more and
more users become interconnected though networks like the Internet,
Compuserve, Fidonet, etc. it becomes increasing easy to move a virus
from one side of the world to the other.

Another relatively new and dangerous sort of virus is the stealth
viruses.  These viruses intercept calls from anti-virus programs as they
scan memory and disks.  Boot sector stealth viruses generally make a copy
of the uninfected original areas and direct scanning programs to the
location of the copy, which appears to be normal.  Stealth file viruses
on the other hand are often able to remove themselves from a file as it
is being scanned, so that the file appears clean.  After the scan is
complete, the virus in memory then moves its code back into the infected
files.

Other recent threats to computer security include the publishing of a book
that tells how to write viruses and includes source code. (I would
prefer not to publicize it and intentionally left out the title.)
Another new threat is the recent posting on various BBSes of a some
programs that help people write mutating viruses.

In fairness to the makers of various anti-virus software manufacturers,
it must be pointed out that most programs on the market include methods
other than pattern scanning.  Most also include TSR's which monitor for
suspicious disk and memory reads and writes.  Some also include various
CRC checking methods which run some sort of algorithm on each file to
create a checksum which is then compared each time the file is executed.
A simple checksum works relatively well if you are absolutely sure that
your files aren't already infected.  The problem is that some viruses
are smart enough to change the checksum values stored on the disk.

So what is the optimal solution...  Well, I have been evaluating several
programs lately (Norton Anti-Virus, Central Point Anti-Virus, Fifth
Generation Untouchable, Certus Novi, Intel LanProtect, Brightworks
Development Sitelock and MacAffee Scan) and the one that seems have the
best potential to deal with the possibility of stealth and mutating
viruses is the relative newcomer, Novi from Certus.

This product does do some pattern scanning, but that is not the basic
paradigm used by this product.  As I understand from my research, all
executable files have essentially the same type of header records.  This
contains the basic information about the program and points to the
beginning of the code to run.  What a virus will do is attach to the end
of the file and change the initial pointer to the start of the virus
code.  At the end of the virus code is a pointer to the start of the
program code.  Thus, the user runs the program, the virus executes and
most likely places itself into memory and then executes the program.

Novi works by checking the critical areas of the file (or disk boot records
for a boot sector scan) to see that everthing is the way it should be.  If
pointers appear invalid or out of place, the product alerts the user to
a problem and then depending on the user response, can attempt to remove
the improper pointers and code.  By not relying on pattern scanning, the
program will working with existing viruses as well as new mutations or
strains.  I am still testing with it and others, but my opinion is that
this program offers the best protection into the future, without the
need of updates.

(This program has also rated very, very well in a variety of recent
magazine article and evaluations.  It's file integrity checking is very
fast and is compatible with the major LAN OSes and with Windows.)

I suspect this article will provoke quite a few responses, and I hope
that some of the above anti-virus manufacturers with be available for
comments.  I'm sure the folks from Certus can tell you a great deal more
about their product and would be more than happy to send you some
literature.  (I'm not here to sell products for them, so I would prefer
not to answer a zillion questions about exactly how the product works.)

Bleys Ahrens

Disclaimer:  I am not affiliated in any way with any of the above
mentioned products and/or companies.  I am an IS professional with a
large international corporation.  While the above evaluations occured
on company time, the opinions and views are strictly my own.

Comments generally welcomed.  Direct flames to /dev/nul...


--
[e-mail] (Bleys Ahrens)
Infoplus BBS, [phone], v32bis. Home of Infoplus.