🚀 go-pugleaf

bartjan@blade.stack.urc.tue.nl (Bartjan Wattel) writes:

> One of *the* best scanners I know of, is:

You forgot to tell -why- you are considering it as one of the best
ones. IMHO, its best feature is that it is user-programmable. It uses
a text file, which contains a database of scan strings. The scan
strings can contain wildcards and in fact the wildcard language
supported is rather powerful. For viruses that cannot be detected with
a scan string (i.e., the polymorphic viruses), it supports the
so-called AVR modules - small assembly-language programs that
implement algorithmic search for these viruses and are loaded at
runtime.

In fact, TbScan contains only the scanning engine; the virus-specific
stuff is provided additionally. The most popular eternal database of
virus signatures is supported by Jan Terpstra.

TbScan is also extremely fast and uses some tricks to speed up the
scanning. For instance, it traces the entry point of the files, until
it reaches a place where the virus should reside and then scans only
this place, thus reducing the disk access significantly.
Unfortunately, it sometimes tries to be too smart and can skip the
place where the virus signature begins. That's why I personally prefer
HTScan, which can use the same format of the signature database and
the same AVR modules, but instead of smart tricks just plainly scans
the whole file. Indeed, I think that there is an option to make TbScan
to scan the whole file.

As far as I know, the latest version of TbScan is 4.3.

> TBScan is shareware, and can be uploaded from several BBS's. For the
> most recent version, call the 'data'-phone number (all baudrates).

More important for the readers of this newsgroup is that it is
available for anonymous ftp from Simtel20 and its mirrors, in the
MSDOS.TROJAN-PRO directory.

> TBScan uses identity scanning, but als heuristic scanning. The
> heuristic scanning algorithm is rather new and seems to be (one of)
> the best there is.

The only problem is that you cannot turn it off. Sometimes I need just
to scan for a particular set of strings in many files, and want a
report about what exactly strings have been found which files. I don't
need the report file to be cluttered with information which files are
considered suspicious by the scanner, because some of its heuristics
have fired... In version 4.3 it is possible to turn off the (long)
explanation of each heuristic each time that it is used, but it is
still not possible to disable the heuristics completely.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany