PCDATPHS.RVW 940101 Comparison Review Company and product: Digital Dispatch, Inc. 9725 Pleasant Avenue South, Suite 2L Bloomington, MN 55420 612-884-9914 800-221-8091 Fax: 612-884-9916 Data Physician Plus! 4.0B Summary: Resident and non-resident scanning, disinfection, activity monitoring, change detection Cost Rating (1-4, 1 = poor, 4 = very good) "Friendliness" Installation 2 Ease of use 2 Help systems 1 Compatibility 3 Company Stability 2 Support 2 Documentation 2 Hardware required 4 Performance 2 Availability 2 Local Support 1 General Description: VIRHUNT is a non-resident scanner, change detector and disinfector (with "generic" disinfection). RESSCAN is a resident scanning program (with a Windows compatible component WIN-RS and a network component, RS-NET). VIRALERT is an activity monitor (with a Windows component, WIN-VA). ANTIGEN adds a change detection module onto executable files, which can also disinfect unknown viral programs which do not change original code, and can add password protection to programs to prevent unauthorized use. Two other (file viewing and "Disk Killer" recovery) utilities are included. Also notable is the fact that the installation program will save copies of the CMOS and "boot records" of the hard drive. Comparison of features and specifications User Friendliness Installation Data Physician Plus! is shipped on three writable and unprotected 360K diskettes. (Each used to be clearly stamped with the serial number in very large, clear digits. I assume this is still the case with regular copies although mine were simply stamped "DEMO COPY". The serial number is not always an easy item to find on any software.) A "Quick Start" sheet, separate from the manual, suggests that you simply run RESSCAN, and then use VIRHUNT if a virus is discovered. (RESSCAN, by default, does a full scan of the disk when invoked, and then remains resident.) The manual is fairly imposing and technically oriented at first glance. (It is unbound, printed one side, and three-hole punched.) Page 10 is the first mention of installation, and suggests that you might wish to run the INSTALL program in order to intall VIRHUNT alone. INSTALL is a "menued" program, but it is hard to say that it is very useful. It does describe the programs, but does so in language that a novice would likely not be comfortable with. The description is not very long, but is followed by the full list of command line options for the program. You can now choose which ones you want and then have them all installed at once. (ANTIGEN is not included in the installation options.) Entries can now be made in your AUTOEXEC.BAT file. INSTALL does have two interesting features. One is the "Recovery" function, which allows the CMOS and boot sector (and presumably the MBR, although this is not explicitly stated) to be stored offline, and restored if necessary to recover a "damaged" disk. (This function is shared by VIRHUNT.) The other is the ability to create "batch" files for running the various programs. A "fill in the blanks" form is presented, and a batch file is created which will run the specified program with the specified options. (The F1 key is stated to give "information": this turns out to be simply the program descriptions as above.) A major deficiency in this function is that the default filename for the batch files is always the same. At first I thought that this meant one batch file could be created in order to run all the programs, but this is not so. Each batch file overwrites the previous one: if a filename exists the user is not warned that the previous file will be lost. (With this in mind, the option to "pause" the batch file if a virus is found becomes somewhat ridiculous.) Do *NOT* use this on AUTOEXEC.BAT. (After installation of a program, there is a similar function to update AUTOEXEC.BAT. It will install RESSCAN and RS-NET in AUTOEXEC. It allows the user the option to backup AUTOEXEC.BAT before changing it.) Ease of use The interface, while not overly difficult, is not particularly easy or consistent. A user familiar with a variety of interfaces will likely be able to find out how it works by trial and error, but a novice may get stuck in certain places. A number of the options are difficult to figure out. Partially this is simply a matter of the complexity of a "useful" system. (Data Physician has a large number of options which could be helpful in a wide variety of situations.) However, in a number of cases it is based upon poorly chosen wording or a lack of information. For example, ANTIGEN can not be used from a write protected disk, even when it is protecting files on another, since it creates temporary work files in its own area. However, the error message is extremely terse and gives no indication of the real problem. As another example, once a list of files for ANTIGEN to protect has been selected, the command to proceed is "Quit". Even having read the manual thoroughly, and after having gotten VIRHUNT to create a signature file for change detection, it took me three runs, by trial and error, to find the correct setting to have VIRHUNT use the signature file to "generically remove" a new virus. A number of option combinations give odd results. For example, in order to use the "generic disinfection", one must "turn off" virus checking. However, if virus checking is turned off while scanning to *create* the change detection signature files, a file with no signatures is created. (To make matters worse, if you specify creation of the signature file, any previous file is overwritten without warning.) Help systems Little provided. A list of viral programs and their "characteristics" is provided in VIRHUNT: it is extremely terse and of very little use. Compatibility Data Physician appears to be very compatible with a variety of hardware, networks and Windows. Company Stability Digital Dispatch's antiviral programs have been on the market for many years, although not widely publicized or marketed. Other products by the company are unknown. Company Support Nothing is mentioned about support, specifically, except that if you get a copy of a new virus to DDI, they will get a fix out by the next day. However, you have to hunt around a bit in order to find the address and phone number. (In fact, the printed address only ever mentions the five digit Zip code. The "5+4" code is found in the "About DDI" section of the VIRHUNT program.) In suggesting that you send a copy of a virus to them mention is made of sending it by modem: no BBS number is listed anywhere. Documentation The documentation is not necessarily poorly written, but is extremely technical in nature. As the technical reference sections appear, the writing becomes more confident. The type of document DDI is used to producing is very obvious. There is little general discussion of viral programs, nor of the strengths and weaknesses of various portions of the program. There are now two substantial READ.ME files on the disk. In fact it is likely that the third disk would not be needed were it not for the fact that the entire documentation for the program exists not only in a text file, but also in an MS-Word format document. Actually, having the softcopy version is very helpful for searching via text editor, as the table of contents isn't very useful. However, the documentation for the virus description language (for specifying newly found, or your "own", viral programs) is still almost entirely on the disk file CIL.DOC--which no longer exists. (It is still referred to in the documentation, so presumably the capability still exists.) Hardware Requirements At least one disk drive, 384K and MS-DOS 2.x or higher. All of the programs will run on a single floppy system. Performance Virus scanning is relatively slow, in comparison to other current products. Most common viral programs are detected, but not all. Identification of some new viral programs which are similar to older ones is not particularly good. Change detection is effective with VIRHUNT, as is the generic disinfection. ANTIGEN however, is much less so. On one test, it did not detect the presence of an infection, although the "protective" code seemed to go through the checking cycle twice. (That test also allowed the infect of other files.) In another test, the infection was caught and successfully removed, but only after infection of another file had occurred. ANTIGEN was never able to stop the infection operation, be it direct action or memory infection. ANTIGEN will conflict with programs with internal loaders or non-standard headers. Local Support None provided. Support Requirements It is unlikely that the novice user would be comfortable using the program at all. The intermediate user may be able to obtain some protection through the use of the program, but is unlikely to be able to utilize it to the fullest extent. Advanced support personnel should be responsible for the installation and configuration of the program. General Notes This is definitely a program for the advanced technical user with a good background in antiviral protection. The package contains a number of protective layers and options, and can perform in a great many situations. The configuration and command line options allow for many different kinds of protection in different environments. It is, however, not a product for the average user. It can certainly be installed on a novice's system by advanced technical support, and contains a number of options for doing exactly that in a large corporate environment. The ability to specify notices to users in the event of infection and the configuration files are two examples here. The product would also be of use to the serious virus researcher supporting a user population. The CIL virus specification language is extremely detailed, and much more effective, in this case, than simple string searching capabilities of other scanners. Recommended for the advanced technical user with advanced knowledge of computer viral programs, in a large user population with centralized responsibility for security. copyright Robert M. Slade, 1992, 1994 PCDATPHS.RVW 940101 ====================== DECUS Canada Communications, Desktop, Education and Security group newsletters Editor and/or reviewer ROBERTS@decus.ca rslade@vanisl.decus.ca BCVAXLUG Envoy http://www.decus.ca/www/lugs/bcvaxlug.html