🚀 go-pugleaf

mramey@u.washington.edu (Mike Ramey) writes:

> Is it possible that the three of you (McAfee, Frisk, and Slade) could
> cooperate to produce a point-by-point comparison of VSHIELD and
> VIRSTOP?

It is just not possible to do such a detailed comparison, because
there are features present in only one of the products.

> One of my questions is this: VSHIELD intercepts a keyboard reboot and
> checks for the presence of an infected diskette in the boot diskette
> drive; it does not allow booting from a (boot-sector?) infected
> diskette.  Does VIRSTOP have this function?  What other differences
> are there?

No, VIRSTOP doesn't have such feature (yet). Other differences are:

1) VShield can check the authentication codes added to the files by
SCAN /AV (it is a BAD idea to modify other people's files!) and refuse
to run those that are not "checksummed". Unfortunately, this feature
can be trivially bypassed (i.e., it is trivial to write a virus that
adds a correct checksum to the file it infects).

2) VShield can scan a file while it is being copied. VirStop does not
have such a feature yet, although Frisk is promising it since a long
time.

3) VShield uses much more memory than VirStop.

4) VShield can be swapped out to the disk, in order to reduce the
amount of memory used. This slows down the loading of the programs.
VirStop does not have such an option (although Frisk intends to
implement it), but then the memory requirements for VirStop are much
more modest.

5) VShield implements some kind of access control - you can tell it
which programs are allowed to run.

6) VShield can be removed from memory (very BAD idea!).

7) VShield can be installed before a network shell is loaded. With
VirStop, you must either install the program after the network shell,
or run without protection. Frisk is expected to fix that problem soon.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany