PCMACE.RVW 910524
Comparison Review
Company and product:
Paul Mace Software
400 Williamson Way
Ashland, OR 97520
USA
tech support 503-488-0224
fax: 503-488-1549
sold and supported through:
Fifth Generation Systems, Inc.
10049 N. Reiger Rd.
Baton Rouge, Louisiana
USA 70809
1-800-873-4384 sales and info
504-291-7283 tech support
504-291-7221 admin
telecopier: 504-292-4465
Mace Vaccine-Anti-viral software version 3.0, 890505
Summary:
Activity monitoring software, plus change detection
Cost
Rating (1-4, 1 = poor, 4 = very good)
"Friendliness"
Installation 3
Ease of use 2
Help systems 1
Compatibility 2
Company
Stability 3
Support 1
Documentation 1
Hardware required 1
Performance 2
Availability 2
Local Support ?
General Description:
SURVEY.EXE is a change detection program which calculates and stores signatures
of files. VACCINE.EXE monitors attempts to modify system areas of hard disks,
and may use the data from SURVEY.EXE to alert to changes in programs as they
are invoked. Recommendation limited to *hard disk only* systems in situations
where technical support staff are responsible for system integrity and need to
have records of changes.
Comparison of features and specifications
User Friendliness
Installation
The program disk is shipped write protected, but on a writeable disk. The
first line of the installation instructions, however, do stress the importance
of write protecting the disk before putting it into any drive.
The README.TXT file is referred to in the installation documentation, but (with
this version) contains only the note that the documentation is up to date.
(The fact that this note is dated two years past is not reassuring.) The
README.TXT file is suggested to be viewed by running README.BAT, but this
requires that the MORE program be in the effective path.
Installation consists simply of copying the files. The files can be renamed,
but the documentation does not note the necessity of keeping the proper
extensions. (Admittedly, any user who knows how to rename files will likely
also know the importance of extensions.)
Ease of use
There are two separate programs in the package. SURVEY.EXE calculates a "check
value" for each file in all subdirectories on the current, or any specified,
disk. The values are kept in a file called HELP.CRC on the root directory of
the checked disk. The check value is a four digit hexadecimal code, and the
name of the file would seem to indicate that this is a CRC calculation rather
than a checksum. Once the "survey" has been done once, all, or specified
individual, files may be checked against it for changes. If a program has been
altered the user is alerted (but no action is suggested) and any changes are
noted in a file called CHANGES.CRC. New programs are not noted in the
CHANGES.CRC file. System areas are not checked: the package relies on the
action of VACCINE to stop any attacks on the boot sector or partition table.
The other program, VACCINE.EXE, is a resident program which can be invoked with
a number of switches to allow for three different levels of protection to
direct action against hard disk system areas. Although the different levels
are explained clearly, the decision as to which level or option to use is not
supported by discussion in the manual.
The package gives the initial impression that these functions are integrated,
and that complete protection against viral infection is provided. Further
exploration, however, reveals that each program must be used indepenently, and
that checks for modification of files or system areas are by no means assured.
Help systems
There are no help systems.
Compatibility
The program does not protect against infection by the Stoned virus, or any
other boot virus. In testing, it did not detect the presence of the infection
on the hard disk, and did not prevent infection of floppy diskettes. Although
the documentation refers to protection of floppy diskettes (and how to turn it
off), further reading indicates that this refers only to prevention of
formatting of diskettes.
Further testing, in fact, reveals that there is almost no protection provided
to floppy disks, and, indeed, that it is *not possible to run the program on a
floppy only system*. The VACCINE program will not go resident if a hard disk
is not present. This is nowhere mentioned in the documentation (which states
that it "works on all IBM and compatible machines with DOS 2.0 or higher, and
uses slightly more that 6K of memory." It is also not noted by the program:
when invoked it merely states that a hard disk is not present.
The VACCINE program apparently makes no attempt to prevent changes to program
or other files, but does prevent changes to system areas of the hard disk.
(Depending upon the level of protection selected, this may only be extended to
the first hard disk.) Therefore, system management utilities may conflict with
the package. The documentation specifically warns against the use of disk
testers, defragmenters or sector editors while VACCINE is operating. The
program can be "turned off" to allow operation of such programs.
Also, any programs which alter their own code will generate alerts by the
SURVEY program, or by VACCINE at level 3.
Company Stability
Unknown.
Company Support
Unknown.
Documentation
The documentation is clear and understandable, but quite sparse (only 15 pages
long.) While directions for operating the program are plain, the implications
of what the program will do are not, even after several readings. (After
testing, the careful wording fo some of the passages becomes clear.
Personally, I find the documentation almost misleading in many areas, although
few can be said to be inaccurate when looked at carefully.)
Hardware Requirements
A hard disk is required, although that is *not* mentioned in the package.
Performance
Able to detect (manually) changes to previously surveyed program files.
Local Support
None provided.
Support Requirements
The package is simple enough for an intermediate user to install. Given the
current climate of viral activity, naive users would have to have immediate
access to experienced advice to interpret the activity of this package, and any
alerts it would generate. Intermediate users would be able to use the program
effectively most of the time, but should have access to skilled help for many
situations.
General Notes
This product has a very high reputation with many as one of the first
commercial antiviral programs. However, the fact that it has not been updated
in two years is surprising. Given that fact, however, the weaknesses of the
program may be understandable. Nonetheless, they are enough to prevent one
from recommending the product in any but the most restricted situation.
copyright Robert M. Slade, 1991 PCMACE.RVW 910524
======================
roberts@decus.ca slade@freenet.victoria.bc.ca Rob_Slade@mindlink.bc.ca
"A fool's brain digests philosophy into folly, science into superstition,
and art into pedantry. Hence University education." -G B Shaw
Author "Robert Slade's Guide to Computer Viruses" 0-387-94663-2 (800-SPRINGER)