NetNews Usenet Archive 1992 #19/NN_1992_19.iso/spool/comp/virus/3708

Internet Message Format | 1992-09-03 | 6.2 KB

Path: sparky!uunet!cs.utexas.edu!sun-barr!rutgers!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: "[e-mail]"@BIIVAX.DP.BECKMAN.COM
Newsgroups: comp.virus
Subject: Re: What is the best anti-virus program???
Message-ID: <[e-mail]>
Date: 31 Aug 92 19:51:37 GMT
Sender: [e-mail]
Lines: 107
Approved: [e-mail]

[e-mail] (Bleys Ahrens) writes:

>All Anti-Virus programs are not created equal.

>Most anti-virus packages on the market today  (Norton, Central Point,
>Untouchable, MacAffee) rely on pattern scanning as their primary method
>of detecting a virus.  In other words, they have a database of some sort
>containing hundreds of strings or attributes that known viruses produce
>when they infect a computer.  This has worked relatively well in the
>past, but unfortunately it is rapidly becoming unpractical.  When new
>viruses and strains are identified, the appropriate patterns must be
>added to the databases of pattern scanning programs.  This may be done
>with updates to the program on disk, via download or manually typing
>strings into the database.

>The problem is that an average of three new viruses are being created
>everyday.  Add to this, the number of new mutating viruses which change
>their appearance and method of operation as they spread and it quickly
>becomes impossible to keep up with the spread of viruses.  As more and
>more users become interconnected though networks like the Internet,
>Compuserve, Fidonet, etc. it becomes increasing easy to move a virus
>from one side of the world to the other.

>Another relatively new and dangerous sort of virus is the stealth
>viruses.  These viruses intercept calls from anti-virus programs as they
>scan memory and disks.  Boot sector stealth viruses generally make a copy
>of the uninfected original areas and direct scanning programs to the
>location of the copy, which appears to be normal.  Stealth file viruses
>on the other hand are often able to remove themselves from a file as it
>is being scanned, so that the file appears clean.  After the scan is
>complete, the virus in memory then moves its code back into the infected
>files.

>Other recent threats to computer security include the publishing of a book
>that tells how to write viruses and includes source code. (I would
>prefer not to publicize it and intentionally left out the title.)
>Another new threat is the recent posting on various BBSes of a some
>programs that help people write mutating viruses.

>In fairness to the makers of various anti-virus software manufacturers,
>it must be pointed out that most programs on the market include methods
>other than pattern scanning.  Most also include TSR's which monitor for
>suspicious disk and memory reads and writes.  Some also include various
>CRC checking methods which run some sort of algorithm on each file to
>create a checksum which is then compared each time the file is executed.
>A simple checksum works relatively well if you are absolutely sure that
>your files aren't already infected.  The problem is that some viruses
>are smart enough to change the checksum values stored on the disk.

>So what is the optimal solution...  Well, I have been evaluating several
>programs lately (Norton Anti-Virus, Central Point Anti-Virus, Fifth
>Generation Untouchable, Certus Novi, Intel LanProtect, Brightworks
>Development Sitelock and MacAffee Scan) and the one that seems have the
>best potential to deal with the possibility of stealth and mutating
>viruses is the relative newcomer, Novi from Certus.

>This product does do some pattern scanning, but that is not the basic
>paradigm used by this product.  As I understand from my research, all
>executable files have essentially the same type of header records.  This
>contains the basic information about the program and points to the
>beginning of the code to run.  What a virus will do is attach to the end
>of the file and change the initial pointer to the start of the virus
>code.  At the end of the virus code is a pointer to the start of the
>program code.  Thus, the user runs the program, the virus executes and
>most likely places itself into memory and then executes the program.

>Novi works by checking the critical areas of the file (or disk boot records
>for a boot sector scan) to see that everthing is the way it should be.  If
>pointers appear invalid or out of place, the product alerts the user to
>a problem and then depending on the user response, can attempt to remove
>the improper pointers and code.  By not relying on pattern scanning, the
>program will working with existing viruses as well as new mutations or
>strains.  I am still testing with it and others, but my opinion is that
>this program offers the best protection into the future, without the
>need of updates.

>(This program has also rated very, very well in a variety of recent
>magazine article and evaluations.  It's file integrity checking is very
>fast and is compatible with the major LAN OSes and with Windows.)

>I suspect this article will provoke quite a few responses, and I hope
>that some of the above anti-virus manufacturers with be available for
>comments.  I'm sure the folks from Certus can tell you a great deal more
>about their product and would be more than happy to send you some
>literature.  (I'm not here to sell products for them, so I would prefer
>not to answer a zillion questions about exactly how the product works.)

>Bleys Ahrens

>Disclaimer:  I am not affiliated in any way with any of the above
>mentioned products and/or companies.  I am an IS professional with a
>large international corporation.  While the above evaluations occured
>on company time, the opinions and views are strictly my own.

>Comments generally welcomed.  Direct flames to /dev/nul...

>--
>[e-mail] (Bleys Ahrens)
>Infoplus BBS, [phone], v32bis. Home of Infoplus.

Comments, anyone?
- --
Arthur L. Rubin: [e-mail] (work) Beckman Instruments/Brea
[e-mail] [e-mail] [e-mail] (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; if you want to be sure I see a
 post, mail it.