Intro to Computers

Syllabus | Assignments | Main | Meet the Teacher | E-mail the Teacher



Catch The Antivirus Bug
We Review How Leading Packages Deliver Their Medicine


Some of the most productive things to do on a computer are the biggest virus risks: downloading files from the Internet, sharing E-mail attachments (though not text-based E-mail messages themselves), using network files, exchanging information on diskettes, and installing software. That means an antivirus strategy is as inevitable as death and taxes for a smart PC user. Without antivirus software on the job, your system is vulnerable to malicious files that can do everything from destroy data to harm system performance.

The good news, however, is that today�s powerful antivirus software lets us enjoy these high-risk activities with hardly a worry. Our review of leading antivirus packages shows that the software has grown so cheap and easy to use and update that fighting viruses has become a low-maintenance activity. As long as you have a modem, making sure your antivirus software has the tools to fight the latest viruses costs no more than 15-odd minutes of connect time or long-distance service once a month. Some products practically update themselves, so users can be sure they have the most up-to-date virus protection available; most software companies even offer these updates free of charge.



  Avoid The Bug.

Before we get into too many details, however, let�s cover a little background about viruses, those infectious, maliciously designed pieces of programming code that can hide in all sorts of files. Knowing how they work prepares you to buy antivirus software. Boot sector viruses are limited to a physical diskette or hard drive and move to a system only when the user turns on the computer while an infected diskette is in its drive. File viruses infect program files or document files and can be spread any way files are shared. Multi-partite viruses use the boot sectors and files as hosts; these less-common viruses can be transmitted by diskette or the Internet.

The biggest virus problem these days, however, is a kind of file virus that spreads through the macro language (sets of self-executing commands) of a word processing or spreadsheet program such as Microsoft Word and Microsoft Excel. These macro viruses often run rampant at corporations that have large networks of users who share files, but E-mail attachments are the biggest source of macro viruses. Another area to watch is a recently discovered formula virus in Excel, called the XF/Paix.A, which installs itself using the spreadsheet�s formulas and can thus change the data in a document. The virus itself isn�t a big problem, but it opens the door to a whole new breed of viruses.

Your only realistic defense against viruses of all shapes and sizes is a full-fledged antivirus program. A good one recognizes a virus, helps remove it, and repairs damaged files. The software should run in the background whenever the computer is on, scanning the computer�s memory plus all accessed files and diskettes. Ideally, the software should perform a full scan of the hard drive at a set interval, such as once a week or once a day.

The software should use heuristic scanning (searching for virus-type behavior, such as a file copying itself to another file or deleting itself without prompting the user) and virus pattern databases or signature files (records of known viruses compared with files on the computer). Most antivirus software companies offer updates to these databases at least monthly. This is key. Programmers constantly create new viruses, and antivirus research facilities discover them all the time�250 times per month, by some estimates. Consumers sometimes think if they buy and install an antivirus program, they need never worry about viruses again. If they never update the software, however, they�re still vulnerable to new strains that come along.

We tested software from the four leading antivirus vendors, as cited by PC Data sales figures, on a computer with an MMX-enhanced 166 megahertz (MHz) Pentium processor, Windows 95 (Win95), 32 megabytes (MB) of random-access memory (RAM), and a 33.6 kilobits per second (Kbps) modem. Though all programs are certified by the International Computer Security Association, some major differences exist as far as program setup and updates.

(NOTE: When looking at antivirus packages, the distinction between updates and upgrades is vague. Updates, which are usually free, refer to the virus signature files; upgrades refer to the product itself, such as a version 3.1 to replace 3.0.)





Dr Solomon�s Anti-Virus 7.0
Dr Solomon�s Software Inc.
$39.95 (estimated street price)
(888) 377-6566, (781) 273-7400
http://www.drsolomon.com

Updates: One free update included with registration. As of June 1 monthly online updates and upgrades are free for the first year, $29.95 per year thereafter through an Internet connection.

Of the software we tested, Dr Solomon�s Anti-Virus has perhaps the most straightforward interface, and its makers are confident in the program�s ability to find more viruses than its competitors�particularly in compressed files�without causing false alarms. Most important, the company is doing something about the program�s biggest downfall�the fee for the monthly viruses update. As of June 1, updates will be free for the first year, and a company spokesperson says anyone who has purchased the software within the 60 previous days will be refunded the cost of the first year�s updates. After that, users will pay $29.95 per year, but that price includes updates and upgrades.

The product, which runs on Windows 3.x and Win95, has an estimated street price of $39.95, which includes one free product update. The company also sells antivirus products for DOS, Windows NT, OS/2, UNIX, and Macintosh platforms.

The program has four components. The included SOS diskette can scan and clean an infected drive, after being used for a clean startup, and the VirusGuard provides protection when the computer is in DOS mode. WinGuard, a 32-bit Windows device driver that by default appears as an icon on the Win95 Desktop, protects the computer while it�s running Windows by checking files and diskettes as they�re accessed. Finally, FindVirus helps users initiate scans on their own.

We had no problems with the installation until it came to registering and receiving our one free update. After spending too much time calling the bulletin board system (BBS) and trying to get it to work, we called technical support and discovered the program�s update options were working incorrectly. Technical support directed us to their temporary World Wide Web site, where the update worked smoothly. The company assured us it was working on the problem, but the �temporary� World Wide Web page already had been up for at least two months.

That much aside, the program is headache-free. By default during installation, Dr Solomon�s appears in the Programs file of Win95�s Start menu. From FindVirus, users can either press the large Update button, or select a drive then press the Scan button. Within the menus, users can set the options so the software scans data files, compressed files, and for unknown viruses. The program also makes it easy to scan drives, directories, or files.

WinGuard can be set to scan all files, scan files on write, and either auto-disinfect an infected file or prompt the user for action. We changed the default setting to enable the crucial program heuristics and Word macro heuristics. From the WinGuard menu, we also personalized and password-protected the messages that appear when viruses are found or deleted. On day 20 of each month, WinGuard reminds users to update virus files via an on-screen prompt containing the Update button.




Like most antivirus programs, Dr Solomon�s Anti-Virus includes an encyclopedia of viruses it can identify.
Several studies have shown that Dr Solomon�s consistently finds a higher percentage of viruses than its competitors, and the program is particularly noted for its ability to scan inside a wide variety of compressed files and also multiple layers of archived files. That leaves the update headaches as the only glaring shortcoming, but at least in June your headaches will be free.

McAfee VirusScan, from the company formerly known as McAfee, stands apart from the pack of antivirus software with a brilliant SecureCast feature that lets Win95 and Windows NT 4.0 users who are online have virus updates automatically pushed to their desktops�but only if they have the patience to set up the program in the first place. (Push technology automatically selects information according to user preferences and sends it to the PC.)



McAfee VirusScan 3.1
Network Associates Inc.
(formerly McAfee Associates)
$49 (estimated street price)
(800) 332-9966, (408) 988-3832
http://www.nai.com

Updates: Lifetime virus signature updates available via the Internet.

The software, now sold by Network Associates, takes three forms. The $49 VirusScan includes VirusScan for Win95, Windows NT, Windows 3.1x, DOS, and OS/2, in addition to the BackWeb program that brings SecureCast. VirusScan Deluxe, for $20 more, adds QuickBackup, modestly termed the world�s easiest backup program. Finally, the VirusScan Security Suite, with an estimated street price of $89, adds WebScanX, which protects users from destructive Active X and Java applets, small programs on Web pages; PC Medic to stop Win95 crashes; PC Firewall to prevent unauthorized users from logging onto a PC through its modem; PCCrypto file encryption; and NetCrypto for protecting network data. The two higher priced versions have two years of free product upgrades, whereas VirusScan has one year.

With the basic version of VirusScan, we opted for the typical, rather than compact or custom, installation. First off, we were told to make a rescue diskette; oddly, none were included. After squinting at the printed instructions, we got a new diskette properly formatted, made the rescue diskette, and tested it.

VirusScan�s VShield is set to launch with the operating system, to scan files when they�re run, copied, created, and renamed, and to scan diskettes on access and shutdown. By default, it only scans program files but can be set to scan files with certain extensions, all files, and compressed files. It will move, clean, or delete infected files, or prompt the user for action. Users can protect certain program options with a password, and a ScreenScan utility can be set to automatically look for viruses when the screen saver is active. Users also can easily set the program to automatically perform certain actions, such as hard drive scans, on a regular basis.




Using a program called BackWeb, McAfee VirusScan automatically pushes virus updates to the desktops of Windows 95 users who surf the World Wide Web.
Ironically, the update procedures initially were the most irritating of the products we tested, but they ended up being the most impressive. Without SecureCast and an Internet connection, one has to go online, download new instructions, decompress them with an unzip utility that makes compressed files usable, then copy the new data files into the VirusScan folder. BackWeb, however, automatically downloads virus updates, personalized news, and other information and pushes it to the user via tickers, wallpaper, and screen savers. After installation the program just started working after we had been online for a good chunk of time. The virus signature files�along with the weather forecast and computer news we�d also signed up for�began appearing magically on the Desktop. When the SecureCast message appeared, we just clicked it and were led through the process.

That�s definitely the most exciting thing we�ve seen when it comes to antivirus products. With or without the pricey but tempting package offer of the Security Suite, VirusScan is a clear standout.




Good antivirus software take cares of regular virus scans and product updates, and Norton AntiVirus Deluxe�s Scheduler is especially easy to program.


Norton AntiVirus Deluxe 4.0
Symantec Corp.
$69.95 (suggested retail price)
(800) 441-7234, (541) 334-6054
http://www.symantec.com

Updates: Free virus updates for life of the product, via modem. Diskette updates via mail cost about $10.

Symantec�s multiplatform Norton AntiVirus Deluxe 4.0 has the most hassle-free system of setting up automatic system scans and virus updates, but once novice users venture out of the realm of the default settings and product updates, they may be overwhelmed by the program�s ability to be highly customized.

The installation is simple, and the options as they were set included an auto-protect, which scans accessed files for viruses, and a start-up scan, which scans critical files and memory for viruses. As suggested, we ran the LiveUpdate at the end of the installation, and our modem dialed up and downloaded the most current virus protection in about five minutes. Although an emergency boot diskette is included, the program also walked us through the creation of a three-diskette rescue set, to help the computer recover in the event of viruses or other problems. The CD-ROM also includes some useful videos.

Win95 users also can run Norton Safe on the Web 1.0 to check and control system security and Norton Secret Stuff for encrypting files. With Safe on the Web, which requires Microsoft Internet Explorer 3.0 or higher or Netscape Navigator 3.0 or higher, the Security Advisor walks you through the security options in the Web browser. It will either change the settings for maximum or above-average security, or help you customize the options. Then, you can opt to make certain information �untouchable,� by preventing unauthorized programs from gaining access to the data in, say, financial files. By helping you set security options, Safe on the Web helps you protect yourself from the growing problem of Web sites that contain hostile Java or Active X applets that may be automatically sent to computers when the user visits an infected Web site. It doesn�t, however, actually identify a hostile applet and those that are OK.

Shrewd consumers should take note�the non-deluxe version, which costs $49.95 instead of $69.95, offers only one year of free upgrades rather than two and lacks Norton Safe on the Web or Norton Secret Stuff. But the last time we checked, full versions of both these programs could be downloaded for free from Symantec�s Web site.

Norton AntiVirus Deluxe�s strong point is its update capabilities, and we especially like the fact that anyone, customer or non-customer, can subscribe to a newsletter from the company�s antivirus research facility. Users who subscribe get the added plus of a small program in the E-mail that will automatically launch the LiveUpdate on their machines.

PC-cillin Anti-Virus 3.0
TouchStone Software Corp./Trend Micro Inc.
$44.95 (estimated street price)
(800) 932-5566, (714) 969-7746
http://www.touchstonesoftware.com

Updates: Free lifetime updates available via the Internet.

PC-cillin Anti-Virus, from TouchStone Software Corp. and Trend Micro Inc., wins the antivirus battle in the race for quick, hassle-free installation, but unfortunately it slows down before reaching the finish line. We had the software, which has a $44.95 estimated street price, installed and running in about 10 minutes, and that included the creation of an emergency boot diskette, although an emergency clean diskette is included in the package. The updating of the signature files, too, was quick and easy. We connected to the Internet, opened a browser, and then went back into PC-cillin and clicked �Update Now.� The download took less than 10 minutes.

Free downloads are included for the life of the product, via the Internet or a modem, although the software says blatantly the company reserves the right to discontinue this service at any time. If you still want to dish out some cash on a regular basis, $29.95 gets you one year of premium support, which includes free upgrades, free technical support at a toll-free number, and priority electronic support.

As for the antivirus action, a feature called the SmartMonitor, which can be accessed by double-clicking the PC-cillin icon in the Win95 status bar, automatically adjusts itself based on what the computer is doing; you can watch the monitored threats change when you, say, go online. More useful is the fact you can see at a glance how current the virus pattern file is�some programs make you hunt for this�and jump straight to pattern updates, scan all the drives, or access the main program.

The program can be set to scan for viruses whenever the screen saver activates, and automatic scans and product updates on a daily, weekly, or monthly basis are easy to set up. You also can choose certain file types to monitor, or certain directories to exclude, and scan archived files and several compressed file formats.

One of PC-cillin�s unique program features is the Virus Doctor. This lets users send an uncleanable file straight from the program�s main menu, where it�s attached to an E-mail message, to PC-cillin, where it will be further analyzed. Also, users of the Eudora E-mail package will appreciate an E-mail plug-in for both Lite and Pro versions. The PC-cillin CD-ROM includes a detailed help file (although installing the included Adobe Acrobat Reader was perhaps the most time-consuming part of the installation). PC-cillin�s help files aren�t fancy, but the information is good.




If PC-cillin can�t clean a virus-ridden file, users can send it straight to the Virus Doctor for further analysis.
Overall, the program format can be a little irritating at first because it can be hard to tell which buttons do anything, and which of those don�t try to jump you online, which wastes time if you�d rather not bother. That, unfortunately, is only a small part of the problem with the time PC-cillin can take. Ironically, once this quick-to-install program was up and running, it seemed to run more slowly than the other antivirus products we�ve tested; our system seemed bogged down, even with twice the recommended amount of RAM.



  Wrapping Up.

Of course, your antivirus options go beyond these four packages. While you�re browsing, you may also come across a few others. For instance, ThunderBYTE Antivirus from NovaStor Authentex (805/579-6700, http://www.thunderbyte.com) is available for an estimated street price of $59.95, and Quarterdeck Corp. (800/683-6696, 813/523-9700, http://www.quarterdeck.com) has entered the game with ViruSweep, with an estimated street price of $39.95. For that same price, you also can get Inoculan AntiVirus for Windows 95 from Computer Associates International Inc. (516/342-5224, http://www.cai.com).

Whatever you choose, there is one quick way to tell if an antivirus program is up to speed. Check whether it�s certified by the International Computer Security Association (http://www.icsa.net), which maintains a list of the viruses both in the zoo (found only in the research environment) and in the wild (found at end-users� computers, usually in more than one place). An ICSA-certified program must identify all the wild viruses in ICSA�s catalog, and at least 90% of the zoo viruses.

Look around, consider your price range, and decide which options will work best for you. The important thing is, make sure your computer has antivirus software, keep it running, and keep it up to date. There�s no other option.  


Syllabus | Assignments | Main | Meet the Teacher | E-mail the Teacher