Simtel MSDOS - Coast to Coast/simteldosarchivecoasttocoast.iso/virus/vaccine.rev

Text File | 1994-03-07 | 6KB | 109 lines

Software Review
by J.D. Abolins  (first submittal: ASCIIRIBER)

VACCINE, VERSION 2.0
(not to be confused with FoundationWare's VACCINE, VERSION 1.2 or several
other programs by the same name.)

WorldWide Data Corporation
17 Battery Place
New York, NY  10004

1-800-643-3000 ext. 123 for all credit card and COD orders from individuals.
1-212-422-4100 for other calls and orders.
1-212-809-7206 for FAXed Corporate Purchase Orders.

For IBM and IBM compatible computers (including PC, XT, AT (286 & 386), and
PS/2 - 30,50,60, or 80) using DOS 2.0 or later.

Sold on a 5.25" 360K floppy diskette only. Not copy-protected. 3.5" diskette
version copies will be provided on exchange basis to REGISTERED USERS ONLY.

Price: $79.95 (Discount prices available for large orders.)

 WorldWide Data's VACCINE is one of the many "anti-viral" software packages
on the market now. These programs offer to guard computers from malicious
computer programs, known as "Trojan Horses" and "viruses". Many of these
programs emphasize the parallels between computer "viruses" and biological
viruses. VACCINE is no exception; its very name has a medical connotation. Its
packaging displays pictures of hypodermics, forceps, Kelly clamps, and other
medical instruments. The medical analogy was so strong, I felt I had to
sterilize my hands before loading the program into the XT.

 The VACCINE package includes one 5.25" diskette, a nine-page instruction
book, registration card, and a couple of information sheets. The diskette
itself included three main programs- VACCINE, ANTIDOTE, and CHECKUP. The are
several utility and sample files files included, as well as a README file for
additional documentation. The instructions were clear, concise, and simple.

 ANTIDOTE, which is the first program to be run when installing VACCINE,
scans executable files on one's hard disk, looking for signs of program code
to any of the various "viruses" known to WorldWide Data. ANTIDOTE can run
periodically to check for suspicious code.

 CHECKUP examines the executable files on one's hard drive, derives checksums,
checks the files' sizes, and compares the information against a file of values
from an earlier CHECKUP run. If the file of previous values doesn't exist,
CHECKUP will create a new one. It will give a status report telling one which
files have been changed, deleted, or added.

 VACCINE is a memory-resident program which detects programs that change
memory tables or they to become memory-resident. To prevent continual false
alarms when running legitimate programs, one must prepare a configuration file
which lists the names of legitimate program which may trigger off VACCINE's
warnings. This is quite simple. The documentation suggests that VACCINE be
invoked by the AUTOEXEC.BAT so that it is always in the background. When it
detects a program attempting to change the memory tables or become memory-
resident, VACCINE sounds off rapid pulsing tones and flashes a warning at the
bottom of the screen. It gives one three options- "Y" to continue the program,
"R" to reboot the system, or "A, Alt-A, or Control-A" to add the detected
program's name to the configuration file.  Simple enough. The option to update
the configuration file is excellent; the update can be done with one
keystroke.

 As mentioned several times above, VACCINE is simple to install and to use.
But a major question remains- "how effective is it against destructive
programs?". Since I don't have samples of "virus" program, I could not run a
full "live ammo" test. Yet from examining and using the package, I have found
several indicators of its capabilities and weaknesses.

 The package does a good overall checkup of the EXECUTABLE FILES. This will
detect most of the "viruses" which infect executable files. VACCINE will not
detect anything that infects other files, such as overlay files. For moment,
most of the "viruses" that I have heard about would be detected by VACCINE
since they, at some point, will affect executable files. There are no such
assurances for the future. A major precaution that must be taken with this
software was with any other "anti-virus" software- one's system must be
"clean" before installing the software. Otherwise, the software may consider
the destructive software as a part of the normal environment. This is why the
VACCINE documention specifies that one uses ANTIDOTE first. But if ANTIDOTE
misses bogus code, it may be a while before CHECKUP of VACCINE detect the
code.

 While running CHECKUP several times, I have noticed a quirk that can cause
problems for some users. I use a subdirectory with a high-order ASCII
character in its name. The first time I ran CHECKUP, it worked well since it
was creating a new checksum/size file. But when I ran CHECKUP again, it gave
me an error message, saying that the program found an invalid character in the
checksum/size file. After experimenting with renaming of the unusual
subdirectory, my suspicions were confirmed. CHECKUP can be thrown off by high-
order ASCII (ASCII 128-255) in filenames or directory names. This quirk makes
it impossible to effectively use CHECKUP on the whole hard disk or on the root
directory; CHECKUP can still used with subdirectories that don't have the
high-order ASCII codes. This should be no problem for most users, but some
users should be aware of this quirk. I know no solution to this quirk other
than changing the filenames or directory names.

  VACCINE was simple to install and to use. It seems to offer a good amount
of protection against the most of the common types of malicious programs. But
will only scan executable files, so other files are still vulnerable. Then
there is the matter of CHECKUP's quirk regarding non-standard filenames. Then
considering the price of VACCINE ($79.00), I would recommend for the average
home PC user to check out some of the other "anti-virus" software before
deciding which one to buy. Some have options that VACCINE does not and many
offer a bit more for less cost. VACCINE will definitely do the job of
providing some protection for one's system. But there is no 100% effective
"anti-virus" program. So whatever software, one uses, one must still compute
wisely.