🚀 go-pugleaf

I orignally tried to E-mail this, but the mailer here doesn't know
about ".dk" as a domain name.

you write:
>How does Norton Antivirus compare to other virus programs, such as
>F-prot and Vscan, apart from that Norton is commercial? Norton is
>almost never mentioned here. Is that because it is commercial or
>because the other programs are better?

It's because the others are better. :)

>scanner". It must be possible to give some unbiased measures of an
>antivirus program, such as
>Approximately how many viruses does it detect?  Does it detect all the
>"important" viruses?  How often is it upgraded?

It is very hard to give an "unbiased" measure of an antivirus program.
Even the number of viruses detected is hard to measure.  How do you
tell whether two closely related viruses are "different"?  Even
discerning whether two infected programs are infected with different
viruses is a subjective judgement.

The frequency of upgrading is important, and easiy measured.
Generally speaking, commercial programs are upgraded less frequently,
due to the costs of new packaging, distribution, and removing the
"old" version from the shelves.  Shareware has the definite advantage
here since it has no packaging, and it is especially simple to remove
the old product from the "shelves".

Other possible determinations to think about:
  + How does it detect new/unknown viruses?
  + Is it easy to use?  How well does it cope with users who might not know
    what they're doing?
  + How much does it cost?
  + Does it offer advice on how to "properly" detect/remove viruses?
  + Does it include a TSR scanner so frequent scanning of the entire drive is
    not needed?

Currently NAV is not highly regarded by independent "experts" such as
Vesselin.  He checks many, many scanners and is probably the best
source for impartial review.  Many of the other experts market their
own products, so they may be biased in their own favor.

Some of the programs I'm biased in favor of:
  + F-prot
     Not only can it detect virtually all known viruses, it also detects many
     unknown viruses.  It includes a TSR to catch viruses before they can
     spread.  It carefully identifies any virus before trying to disinfect it
     from a file.  Best of all it's free for users on their own personal
     computer at home.  $1 US per CPU otherwise.
  + Integrity Master
     While this program is a poor virus scanner in and of itself, it is very
     useful as an integrity checker to catch anything that might wiggle its
     way through F-prot.

Some of the programs I'm biased against: (Please note that these are
not necessarily reviews of the most recent scanners available.  Once I
find a product I don't like, I usually don't go out and buy a new copy
just to see if it's still as bad as before...;-)

  + SCAN
     McAfee associates consistently refuses to adequately upgrade their
     scanner.  Many people have noted problems (bugs, missed viruses, etc.)
     that reappear version after version.  One serious problem with CLEAN is
     it doesn't check to see if the virus you are asking it to disinfect is
     even present.  If you enter the wrong thing, it will trash the program.
     Sometimes SCAN will mis-identify a virus, and the same thing happens.
     SCAN's virus naming strategy is also cryptic at best, and changes from
     version to version.
  + CPAV
     CPAV does not coexist well with other antivirus programs.  It gives false
     positives, and misses many viruses.  It is a complete pile.

Anyway, I hope this helps you out some.  While it is not possible to
give "unbiased" information about scanners, the above is what my
experience has told me.

What I'd like to see in a scanner:
   + A notice advising the user that booting from a clean floppy is a good
     idea if the program is run from the HD.
   + A notice telling that user that disinfection can result in file damage,
     and many times the program will be changed even if it still functions.
   + A uniform naming sceme, such as CARO.  Maybe just a command line switch
     to turn on CARO naming versus the "standard" proprietary naming schemes.
   + A database of viruses detected and what they do, even just detailing the
     mode of infection.  More info would be nice, tho.  (F-prot is pretty
     good about this, although it would also be nice to know where in the file
     or disk the viral code lies.)
   + The ability to allow the user to add new scan strings, including the use
     of wildcards.  (F-prot does this w/o wildcards.)

What I'd like to see in an integrity checker.
   + Integrity data kept off the hard drive, or in a single file on the hard
     drive.
   + Option to tell the program never to check certain files, such as Stacker
     volumes which will almost always show up as changed.
   + The same "clean boot" notice as above.

What do all you developers think?  Any of these reasonable?

  -- 007
- -- 
 000   000  7777 | sbonds@jarthur.claremont.edu
0   0 0   0   7  |----------------------------------------------------------- 
0   0 0   0  7   |        Childhood is short...
 000   000   7   |                    ...but immaturity is forever.