From lehigh.edu!virus-l  Fri Feb  9 14:32:22 1996 remote from vhc
Received: by vhc.se (1.65/waf)
	via UUCP; Sun, 11 Feb 96 17:00:15 GMT
	for mikael
Received: from fidoii.CC.Lehigh.EDU by mn3.swip.net (8.6.8/2.01)
	id OAA10999; Fri, 9 Feb 1996 14:32:22 +0100
Received: from fidoii.cc.lehigh.edu ([127.0.0.1]) by fidoii.cc.lehigh.edu with SMTP id <39483-67730>; Fri, 9 Feb 1996 08:29:17 EST
Message-Id: <01I115C9JL1YPVIUA3@csc.canterbury.ac.nz>
Reply-To: virus-l@lehigh.edu
Originator: virus-l@lehigh.edu
Sender: virus-l@lehigh.edu
Precedence: bulk
From: VIRUS-L Moderator <virus-l@cantva.canterbury.ac.nz>
To: Multiple recipients of list <virus-l@lehigh.edu>
Subject: VIRUS-L Digest V9 #20
X-Listprocessor-Version: 6.0c -- ListProcessor by Anastasios Kotsikonas
X-Comment: Virus Discussion List
Date: 	Fri, 9 Feb 1996 08:27:04 EST

VIRUS-L Digest  Saturday, 10 Feb 1996    Volume 9 : Issue 20

Today's Topics:

Integrity Master (DOS)
VET (DOS/Windows)
SIX and BRECT (DOS)
Rising Anti-Virus Card (DOS/BIOS)
VirusNet PC (DOS/Windows)
Antiviral Toolkit Pro (AVP) (DOS)
F-PROT Professional (Command Software) (DOS/Windows)
McAfee Scan suite (DOS/Windows)
F-PROT version 2.xx (DOS)

VIRUS-L is a moderated, digested mail forum for discussing computer
virus issues; comp.virus is a gatewayed and non-digested USENET
counterpart.  Discussions are not limited to any one hardware/software
platform--diversity is welcomed.  Contributions should be relevant,
concise, polite, etc.  (The complete set of posting guidelines is
available by FTP on CS.UCR.EDU (IP number 138.23.169.133) or upon
request.)  Please sign submissions with your real name; anonymous
postings will not be accepted.  Information on accessing anti-virus,
documentation, and back-issue archives is distributed periodically on
the list.  A FAQ (Frequently Asked Questions) document and all of the
back-issues are available by anonymous FTP on CS.UCR.EDU.

Administrative mail (e.g., comments or suggestions) should be sent to
me at: n.fitzgerald@csc.canterbury.ac.nz.  (Beer recipes should still
be sent to Ken van Wyk at: krvw@mnsinc.com.)

All submissions should be sent to: VIRUS-L@Lehigh.edu.

   Nick FitzGerald

----------------------------------------------------------------------

Date: Fri, 12 Jan 1996 16:44:22 -0500 (EST)
From: "Rob Slade, the doting grandpa of Ryan Hoff" <roberts@mukluk.hq.decus.ca>
Subject: Integrity Master (DOS)
X-Digest: Volume 9 : Issue 20

PCIM.RVW   950826
                               Comparison Review

Company and product:

Company: Stiller Research
Address: 2625 Ridgeway St., Tallahassee, FL  32310-5169
Phone:   +1-904-575-0920
Fax:                                   +1-904-575-7884
Email:   74777.3004@compuserve.com
Other:   http://delta.com/stiller/stiller.htm
Product: Integrity Master change detection software

Summary: Change detection program with built in signature scanner

Cost: U$32.50, licensing available

Rating (1-4, 1 = poor, 4 = very good)
      "Friendliness"
            Installation      3
            Ease of use       3
            Help systems      4
      Compatibility           3
      Company
            Stability         3
            Support           3
      Documentation           4
      Hardware required       4
      Performance             3
      Availability            2
      Local Support           2

General Description:

IM is a change detection program with built in scanner.  SETUPIM is an
installation and tutorial program.  (A Windows installation program is included
which will set up a program group for commonly used functions.)  Also included
are a file viewer, printer scheduler and utilities to check the efficacy of the
system.

                  Comparison of features and specifications



User Friendliness

Installation

Integrity Master is sold directly from Stiller Research and agents.  A fully
functional version is distributed as shareware, and Stiller Research is a
member of the Association of Shareware Professionals.  The shareware
distribution archives for Integrity Master are full of files, a large number of
which relate primarily to the distribution and description of the program.  The
number of files is somewhat daunting, as is the size of the README.DOC file.
The file does, however, start with the suggestion that the novice simply run
the SETUPIM program, and this is worthwhile advice to follow.

I received also a version on disk from the developer on a 1.44M unwritable
diskette.  If a shareware author can do this, there is no excuse for the
commercial operations.

Calling SETUPIM an installation program is misleading.  It is less than an
installation program -- and much, much more.  For the novice user, SETUPIM has
some of the most "user-friendly" features of any product yet reviewed.  It
certainly has the best explanations of the antiviral process and the options
for security of any installation program.

Although the program and system, overall, is well designed and has advanced in
respect of virus detection technology I was quite surprised to note that the
installation procedure has not fixed some earlier bugs.

While there is provision for installation to a drive other than C:, there is no
option to change the default installation directory.

The programs (both IM and SETUPIM) have a command line switch that "forces"
monochrome mode with a monochrome monitor on a "colour" adapter.  This is
important, since some of the menu "highlighting" is invisible on a monochrome
monitor.  The programs *can* change to monochrome in "mid-session", so it
should not be difficult to add a short "screen test" for the completely novice
user, rather than making them use the command line option.  (This applies only
to SETUPIM: a proper installation will tell IM which video mode to use.)

(If IM is invoked before SETUPIM is run to create the parameter file, IM will
refuse to run.  Three options are presented, including "Abort" which is
described, with an unusual lack of clarity, as "Quit and return".)

The SETUPIM program prepares a parameter file for use by IM (which sets up the
various options for running the integrity checks), and produces a suggested
procedure for completing the installation, but it does not actually do the
copying and placement of files, or the invocation of the initial "signature"
calculations.  While readily admitting the value of having a "cold boot" before
this is done, it should be possible to do some more of this for the novice user
before turning him loose with a (softcopy) instruction set.  Alternately, the
installation program could strongly suggest that a "cold boot" and other
security measures are desirable, but offer to proceed with installation if the
user desired, on the clear understanding that this is "second best".  (This
approach is taken with some of the options during the setup.)

This is not to say that the instructions in the IMPROC.TXT (the suggested
installation procedure document file produced by SETUPIM) are in any way
inadequate.  The instructions are clear and straightforward.  The file is
displayed to the user at the end of the SETUPIM part of the installation
process, and the user is given the command to invoke the IMVIEW file viewer in
order to review the file later, or the IMPRINT batch file in order to print it
in hardcopy.  (The IMPROC.TXT is unclear at one point, the one where almost
everyone seems to fall down.  The document contains the injunction to "cold
boot" the computer, and it is probably not clear to the novice user that this
does not mean to do it "right now".)

The SETUPIM program also contains a tutorial.  Both the operation of the
program, and the conceptual aspects of virus protection, data loss and security
measures are covered.  This is extremely useful, and the only problem I have
with it is to wish that some more of the material from the documentation could
be included.

The installation procedure does not address installation of IM in the
AUTOEXEC.BAT file, although use of scheduling software is mentioned in places.
The installation process does, however, suggest the preparation of a bootable
disk with IM files on it for recovery purposes.  If the installation process is
interrupted, a screen message suggests the option of installing via the Windows
program, IMWIN.  While this does set up a Windows program group, one of the
items in the group must then be chosen in order to complete installation.

Ease of use

The screens, menus and options are well laid out, and labels are well chosen
with a view to clarity of meaning.  The SETUPIM program is amazingly well
designed with the novice user in mind.

At a couple of points during installation the user can be left staring at a
screen and possibly wondering if he did something wrong.  (The amount of time
this takes, however, varies widely depending upon the speed of the machine.)
The program noted that there was no boot sector on my boot drive since it reads
the sector with an interrupt which conflicts with LANtastic server software.
At times, the program is stepped (or "timed") through a sequence which begins
to suggest the possibility of an infinite loop.  (The "timed" stepping is
probably a good idea here; some users may give up before it reaches the
conclusion.)  The tutorial, at certain points, requests specific keystrokes but
accepts anything, not a pedagogically sound design.  Some minor keystroke
"trapping" and a "please press the arrow key, you can practice later" message
would improve it.

The GUI, windows and menus are here used as they are meant to be in order to
make the program useful and quick to operate.  Not only is the label and option
wording well chosen, but each item, as it is selected, pops out a window with
extra explanation about what it does.  Often the window will contain a brief,
but clear, discussion of the pros and cons of using this particular option.

Help systems

Help is only partially context sensitive.  The help key, however, brings up
options for help with the operation of the program, the screen display, or a
help index.  (If the index is chosen, the currently "open" menu is "selected".)

However, the explanatory "window" beside each selected item seems to largely
obviate the need for any kind of help system.  (On items where the explanation
could be confusing, for example the "Files to iNitialize" options, the help
index is of little assistance, and one would need recourse to the manual.  The
index is, however, very extensive, even covering what the AUTOEXEC.BAT file is,
although with less detail than a novice would need in order to automate
checking.)

Compatibility

The documentation notes possible problems with file locking under LANs, Windows
and OS/2.  Potential problems with LANs are noted and recommendations are made
for specific operating systems.

Company Stability

Both the change detection and scanner components of the product are mature and
stable.  The scanner, although the secondary part of the package, ranks quite
well in scanner tests, and has been consistently maintained over the years.

Company Support

Support is available via fax, phone and email as well as through a pay-per-call
third party number.  Registered users may call direct for support, and it is
available through at least two BBSes.

(Note that ASG, the pay-per-callnumber, is completely independent of Stiller
Research.  Stiller Research does not receive any of the charges for support
provided through ASG.)

Documentation

Integrity Master's documentation is a massive text file, which begins with a
section intriguingly titled "Don't Read This".  This is, in fact, a suggestion
to novice users that they skip the first section, on the workings of I-M, and
just use the installation program.  It also suggests that they *do* read the
second section, which is a general treatment of viral programs and the various
other types of data disasters which commonly occur.

The documentation as a whole has a "technical" flavour, but is clear and
unambiguous.  The intermediate user should have no problem with the first
section, but might be well advised to read section two first, in order to have
a clear grasp of the reasons for the various options IM offers.

Section two's overview of viral programs and other risks to data contains
excellent information.  It could form the basis of a very useful primer on data
integrity as a whole.

Hardware Requirements

A minimum of 260K memory and DOS 2.x or higher is required.  Refreshingly, a
hard disk is not.  It appears that IM can be installed on any disk that has
room for the programs and files.  In fact, IM can be installed on a hard disk,
and then the IM.EXE and IM.PRM files copied to a floppy and used anywhere.  IM
does not "demand" the presence of the equipment it was originally installed on.

Performance

Installation and calculation of signatures for the full hard disk was faster
than for other tested change detectors.  IM states that its "quick check" looks
only for changes to the file date and size.  It is likely that the "turbo" mode
of other change detectors do the same, without being as honest about it.

(With all the information presented onscreen each time an option is selected,
it is remarkable that IM is extremely responsive.)

The storage of "signatures" is a matter of much debate.  IM stores them in each
directory checked.  There is, however, provision for storage of the signature
files on an "offline" diskette, which adds a security factor.

IM's virus scanning picked up all common viral programs tested against it, and
a good many that were less so.  Some new viri were detected on the basis of
similarity to known code.

Local Support

None provided.

Support Requirements

As with any change detection program, assignment of causes to different types
of alterations may be problematic.  However, the program itself should provide
ample explanation to any reasonably intelligent person, regardless of the level
of "computer" background.  The integrated virus scanner should be of great
assistance with identifying the most commonly seen viral programs.

                                 General Notes

Recommended as the change detection component of virus detection or protection
for all levels of computer users.

copyright Robert M. Slade, 1992, 1995   PCIM.RVW   950826

======================
ROBERTS@decus.ca, RSlade@sfu.ca, Rob Slade at 1:153/733 RSlade@cyberstore.ca
                    Frequent advice to Internet newcomers:
 State your business, avoid eye contact, leave quietly, and no one gets hurt.
Author "Robert Slade's Guide to Computer Viruses" 0-387-94311-0/3-540-94311-0

------------------------------

Date: Fri, 12 Jan 1996 16:45:13 -0500 (EST)
From: "Rob Slade, the doting grandpa of Ryan Hoff" <roberts@mukluk.hq.decus.ca>
Subject: VET (DOS/Windows)
X-Digest: Volume 9 : Issue 20

PCVET.RVW  950808
                               Comparison Review

Company and product:

Company: Cybec
Address: PO Box 205, Suite 3, 350 Hampton Street, Hampton, Victoria   3188,
         Australia
Phone:   +61 3 9521 0655, +44-6-0683-6780, +353-5-138-3650, +605-281-2757,
         +649-378-9790
Fax:     +61 3 9521 0727
Contact: Nichols Engleman, Roger Riordan
Email:   support@cybec.com.au, sales@cybec.com.au
Product: VET antiviral 8.2


Summary: Scanner, two option resident scanner, activity monitor, disinfector,
change detector and utilities.
                             

Cost   A$90.00 for 1 year license, updates posted quarterly

Rating (1-4, 1 = poor, 4 = very good)
      "Friendliness"
            Installation      3
            Ease of use       3
            Help systems      2
      Compatibility           3
      Company
            Stability         3
            Support           3
      Documentation           3
      Hardware required       4
      Performance             3
      Availability            2
      Local Support           2

General Description:

VET is a fairly standard scanner/disinfector with a strong emphasis on boot
sector infectors.  VET_RES is a resident scanning system with various options.
Utilities included are VCRC, for change detection; HUNT, a "baiting" change
detector, and VET_TRAP which saves MBR, boot sector and "top of memory" data
for evaluation of suspect new virus.  A Windows interface is available, and a
NetWare NLM is in final test and should be available when this review sees
print.


                  Comparison of features and specifications



User Friendliness

Installation

The program is shipped on a writeable but protected 720K diskette, with another
for the Windows interface.  The installation program is very well prompted, and
explains the choices the user has to make.  Two or three sentences of rationale
are given as the user cycles through the options presented.  Standard
installation, while somewhat more complicated than some other products, is
quite reasonable, and should give the novice no problem.  (Ironically, a
possible exception is the installation of the Windows interface.  The interface
uses the VET program, but is separate from it.  Installation of VET adds to the
PATH command in the AUTOEXEC.BAT file, but if the Windows interface is
installed immediately following, without an intermediate reboot, VETWIN won't
be able to find VET.)  Custom installation, however, should only be attempted
by intermediate or advanced users, and that only after all of chapter one has
been read.  The manual is somewhat technical, but computer support personnel
should feel right at home.  (Given VET's origin in college computer labs, this
orientation is quite reasonable.)

Having said that, technical support staff will find a number of helpful
functions for customizing installation, and for aiding installation in sites
with many PCs.  Both "Master" and "Network" options assist in initiating the
program on mulitple PCs in a corporate environment.

The installation process is very "careful" and should ensure that no virus
contaminates the program.

Installation is possible on systems with no hard drive, but some of the
installation functions, such as modification of AUTOEXEC.BAT, are not
performed.

Ease of use

Most of the VET programs are command line, rather than menu, driven, but the
default usage should be easy enough for most novice users.  Users are told very
plainly about problems, as well as possible, and recommended, courses of
action.  Novice users will find that standard usage gives them a fairly solid
measure of protection.  The only important part of the package that is
difficult to use is the change detection component.  Intermediate and expert
users will find various options which can increase the level of security, or
avoid conflicts in specialized environments.

Help systems

A list of command line options can be obtained with the "?" switch.

Compatibility

No problems were found in testing.  A Windows interface for the VET program is
available.  The VET_RES programs will sound an audible alarm running under
Windows, but will not display the warning screen.  Suggestions are made to
allow co-existance with various networks.

Company Stability

Cybec has a significant presence on VIRUS-L, as well as other research groups.
It is now to be considered among the top international virus research
companies.

Company Support

The usual.  In addition, Cybec is fairly active on VIRUS-L/comp.virus, and is
reachable through the Internet.  The product is updated quarterly for those
with a valid license.  Updated documentation on disk makes this look almost
like a shareware package.  A newsletter called "Cyclops", available to
customers, is not as detailed as the "F-PROT Bulletin", but is a lot funnier.

Documentation

The documentation is now excellent in terms of program operation.  The removal
of the primer material and the humour is disappointing.  Introductory level
explanations are, however, inegrated throughout.

System Requirements

No special hardware is needed.  The program will work with MS-DOS 2.x or
higher, and can be run from a floppy disk if needed.

Performance

There is a very strong emphasis on boot sector protection in the package, not
surprising, in that it started life as a defence against Stoned and produced
the "Man who named Michelangelo".  Data bases, detectors and recovery tools are
included for analysis of the boot sector and master book record.  VET_RES
checks the boot sector every time it monitors a change in a floppy disk in the
drive, and checks for a disk in the drive when <Ctrl><Alt><Del> is pressed.

Scanning is among the fastest reviewed, and ranks with Thunderbyte and
Virex-PC.

Unfortunately, the program has not been included in many of the most widely
distributed independent scanner trials.  My own tests do not indicate any
shortcomings in the scanning coverage of the program.

Local Support

The company is reachable via the Internet.

Support Requirements

VET is suitable for all user levels, but is particularly recommended for
supported sites.

                                 General Notes

An improvement in the change detection component would contribute to the full
multi-layered defence.  VET is, however, a  significant package, and well worth
serious consideration, particularly in large environments.

copyright Robert M. Slade, 1993, 1995   PCVET.RVW  950808

======================
ROBERTS@decus.ca, RSlade@sfu.ca, Rob Slade at 1:153/733 RSlade@cyberstore.ca
  "Internet, the information network you _can't_ outgrow."  - Ido Dubrawsky
Author "Robert Slade's Guide to Computer Viruses" 0-387-94311-0/3-540-94311-0

------------------------------

Date: Fri, 12 Jan 1996 16:45:38 -0500 (EST)
From: "Rob Slade, the doting grandpa of Ryan Hoff" <roberts@mukluk.hq.decus.ca>
Subject: SIX and BRECT (DOS)
X-Digest: Volume 9 : Issue 20

PCSIX.RVW   950911

                               Comparison Review

Company and product:

Company: Zen Works
Address: P. O. Box 528, Houlton, ME   04730
Contact: R. Wallace Hale
Email:   halew@nbnet.nb.ca
Other:   BBS +1-506-325-9002
Product: SIX, BRECT


Summary: system and memory change detection


Cost free for non-commercial, non-governmental use

Rating (1-4, 1 = poor, 4 = very good)
      "Friendliness"
            Installation      3
            Ease of use       2
            Help systems      1
      Compatibility           3
      Company
            Stability         3
            Support           2
      Documentation           2
      Hardware required       4
      Performance             2
      Availability            2
      Local Support           1

General Description:

SIX is a small and specialized change detection program designed to check
system and memory after the boot process has completed.  It will detect changes
to itself, memory and certain interrupts.  (BRECT is an advanced utility to
patch floppy diskettes in order to remove infections.)


                  Comparison of features and specifications


User Friendliness

Installation

SIX is distributed as shareware.  The program is a single small file.
Installation could be as simple as copying the SIX.COM file to an appropriate
place on the disk and adding the program to the end of the AUTOEXEC.BAT file.
SIX will take a snapshot of memory on first invocation, and check it on each
invocation thereafter.

Ease of use

SIX and BRECT are meant as simple, single purpose tools.  They require an
understanding of what you are doing, but have no complexities in operation.

Help systems

None provided.

Compatibility

SIX may report and alert if run after programs which make significant changes
to memory or interrupts.  It should be easily network compatible, but only if
used from the same station each time.

BRECT will write a non-bootable boot sector to floppy disks, and so will remove
the boot capability if used on bootable disks.

Company Stability

Wallace is a nice guy with interesting ideas but if he goes under a bus you can
kiss your support goodbye.  Also, if the programs mess you up (or, more likely,
you mess up), the warranty is limited to what you paid.  (See above.)

Company Support

Postal, email or BBS only. 

Documentation

The text files clearly explain the operation of the programs, but assume you
are familiar with viral operations and do not go into tutorial details.

System Requirements

Basically, anything that runs DOS.

Performance

Within the limits, good.

Local Support

None provided.

Support Requirements

SIX would be a good add-on to a supported environment.  As the author states,
it is not intended as a full antiviral package, but only as an additional,
quick level of checking.

copyright Robert M. Slade, 1995   PCSIX.RVW   950911

======================
roberts@decus.ca   rslade@cln.etc.bc.ca   Rob.Slade@f733.n153.z1.fidonet.org
               Crossbows don't kill people, quarrels kill people
Author "Robert Slade's Guide to Computer Viruses" 0-387-94311-0/3-540-94311-0

------------------------------

Date: Fri, 12 Jan 1996 16:47:19 -0500 (EST)
From: "Rob Slade, the doting grandpa of Ryan Hoff" <roberts@mukluk.hq.decus.ca>
Subject: Rising Anti-Virus Card (DOS/BIOS)
X-Digest: Volume 9 : Issue 20

PCRAVC.RVW   950915

                               Comparison Review

Company and product:

Company: Rising Computer Science and Technology Company
Address: Level 3, North Block, Yi Bin Fan Dian, Hai Dian District, Beijing
         100080, P. R. China
Phone:   256-7073
Fax:     256-4934
Contact: Alex Lau
Email:   alau@sirius.com
Product: Rising Anti-Virus Card (RAVC)


Summary: hardware based activity monitor for Intel/BIOS/ISA computers


Cost: unknown

Rating (1-4, 1 = poor, 4 = very good)
      "Friendliness"
            Installation      2
            Ease of use       2
            Help systems      1
      Compatibility           3
      Company
            Stability         2
            Support           1
      Documentation           1
      Hardware required       4
      Performance             2
      Availability            1
      Local Support           1

General Description:

Small form factor ISA card with ROM extensions for activity monitoring and
write protection.


                  Comparison of features and specifications


User Friendliness

Installation

The package, as I received it, had the card, a 1.44M writable but protected
disk and no instructions.  Installation should apparently be a simple matter of
installing the card.  None of the four programs on the disk appear to be
necessary either to installation or to operation.

There are four dip switches on the card.  The MEMTEST program seems to have
provision for determining what the positions of the switches should be, but in
my installation it did not give any clear statement, and the positioning which
seemed to be indicated was not correct.

On first installation, the card produced a ROM checksum error and denied access
to the hard disk.  After a number of installation attempts, the card allowed
the system to boot normally.

Ease of use

When a suspect activity is detected, the user is presented with a box onscreen
In some cases this is a clear direction, such as to reboot the computer from a
clean disk; an informational message, such as notice that a suspect program has
been removed from memory; or a rather terse menu of choices to reboot, "Yes"
(allow the suspect operation) or abort (the program currently running).

Help systems

None provided.

Compatibility

The program did not produce overt conflicts with programs.  Utilities
performing disk writes to system areas and modification of programs will
generate alerts and may be terminated.  Testing with a limited set of viral
programs did not uncover any obvious weaknesses in the package.  The RAVC was
not tested with Windows, but does not appear to have provisions for it.  (With
other similar packages the alert screen does not appear but the alert beep can
be heard.)

Company Stability

Unknown, but said to be a major vendor in China.

Company Support

None provided.

Documentation

None provided.  This makes determination of other factors difficult.

System Requirements

Stated to be DOS 2.0 or higher.  The card will work with any 8 or 16-bit ISA or
EISA slot.

Performance

The activity monitor appears to check for modification of .COM and .EXE files,
but not .BAT or .SYS.  Boot sector infectors are prevented from infecting the
hard disk.  In the case of a boot sector infector, the user is requested to
boot from a clean system disk, but this does not appear to be necessary.
Attempts to write or copy to .COM files produced irregular alerts, but I was
never able to get a virus to successfully infect.  System infectors which do
not directly write to executable files were also unsuccessful.  Companion viral
programs were not tested but the creation of new executable files usually
prompted an alert.

Copying or updating of software files is subject to numerous alerts and the
RAVC would likely be unsuitable for development environments.  It should
probably be removed during software upgrades.

Programs provided for the setting and clearing of passwords, and a network
program, have no discernable effect on operation.

Local Support

None provided.

Support Requirements

If there are no problems with installation, this could be used unsupported in
an environment where programs are not changed.

copyright Robert M. Slade, 1995   PCRAVC.RVW   950915

======================
roberts@decus.ca     rslade@vanisl.decus.ca     aa046@freenet.victoria.bc.ca
      If you're not part of the solution, you're part of the precipitate
Author "Robert Slade's Guide to Computer Viruses" 0-387-94311-0/3-540-94311-0

------------------------------

Date: Fri, 12 Jan 1996 16:48:36 -0500 (EST)
From: "Rob Slade, the doting grandpa of Ryan Hoff" <roberts@mukluk.hq.decus.ca>
Subject: VirusNet PC (DOS/Windows)
X-Digest: Volume 9 : Issue 20

PCVRSNET.RVW   950804

                               Comparison Review

Company and product:

Company: Safetynet, Inc.
Address: 140 Mountain Ave, Springfield, NJ 07081
Phone:   +1-201-467-1024, 1-800-OS2-SAFE
Fax:     +1-201-467-1611
Email:   support@safe.net, safety@gti.net
Other:   BBS: +1-201-467-1581, http://www.safe.net/safety/,
         ftp://ftp.safe.net/pub/safetynet/
Product: VirusNet PC (contains F-Prot, cf Frisk)


Summary: Manual and resident scanning, plus change detection.


Cost U$75

Rating (1-4, 1 = poor, 4 = very good)
      "Friendliness"
            Installation      3
            Ease of use       3
            Help systems      2
      Compatibility           3
      Company
            Stability         3
            Support           3
      Documentation           3
      Hardware required       3
      Performance             4
      Availability            2
      Local Support           3

General Description:

A repackaging of the F-PROT scanner with a Windows interface.  Change detection
and event scheduling has been added, as well as boot sector recovery.  LAN
version available.


                  Comparison of features and specifications


User Friendliness

Installation

The program is shipped on 2 unwriteable 1.44M disks.  Setup programs are
provided for both DOS and Windows.  The Windows installation establishes both
versions.

The Windows programs uses, and installs, VBRUN300.DLL.  This is the dynamic
link library used by "runtime" compiled programs produced with Visual Basic.  A
number of Windows programs may try to install and use this file, and conflicts
may result as successive versions of the file are replaced.  VirusNet PC uses
version checking and will not replace a newer version of this file.

Ease of use

The interface is reasonably clear.  Not all options are available from the menu
system, some must be invoked from the command line.

Help systems

Online help is available.

Compatibility

The LAN version is said to work with all DOS based networks.

Company Stability

SafetyNet has been around for some time, and Frisk Software is a leader in
antiviral technology.

Company Support

Nothing is mentioned in the manual, but the registration card has a tear-off
portion listing a separate support line, plus fax, BBS and email.
Correspondence with the company states that toll-free help is now available in
North America.

Documentation

The documentation is quite clear, and has a simple but sound virus overview.

System Requirements

DOS 3.0 and higher, Windows 3.0 and higher, 400K memory.

Performance

As per the various versions of F-Prot.

Local Support

Toll free (800 number) support in North America and Internet email.

Support Requirements

The package is recommended for unsupported environments.

copyright Robert M. Slade, 1995   PCVRSNET.RVW   950804
======================
ROBERTS@decus.ca      rslade@vanisl.decus.ca      Rob_Slade@mindlink.bc.ca
    The client interface is the boundary of trustworthiness - T. Buckland
Author "Robert Slade's Guide to Computer Viruses" 0-387-94311-0/3-540-94311-0

------------------------------

Date: Fri, 12 Jan 1996 16:49:37 -0500 (EST)
From: "Rob Slade, the doting grandpa of Ryan Hoff" <roberts@mukluk.hq.decus.ca>
Subject: Antiviral Toolkit Pro (AVP) (DOS)
X-Digest: Volume 9 : Issue 20

PCAVP.RVW   950921
                               Comparison Review

Company and product:

Company: KAMI Ltd.
Address: 109052 Nizhegorodskaya st. 29, Moscow, Russia (until Jan, 1996)
Address: 123364 Geroev Panfilovtcev str., 10, Moscow, Russia
Phone:   +7 (095) 262-1294, 923-0261
Fax:     +7 (095) 278-9418, +7 (501) 882-8628
Sales:   ALEX International Inc.&Co., Credit Suisse, ch-8070 Zurich,
         Paradeplatz, 8, Postfach 590G134; MC3162@mclink.it; Central Command
         Inc., P.O. Box 856 Brunswick, Ohio 44212, +1-216-273-2820,
         sales@command-hq.com; pierrev@ibm.net; roger@sydney.dialix.oz.au;
         vac@uucp.polbox.com.pl; mannig@world-net.sct.fr; prokon@gtc11.gtc.net;
         avp-support@metro-net.ch; 100120.503@compuserve.com
Contact: Eugene Kaspersky
Email:   eugene@kamis.msk.su, avp-support@icomm.rnd.su, natalya@kamis.msk.su
Other:   BBS: +7 (095) 278-9949, FidoNet: 2:5020/156, http://www.icomm.rnd.su/,
         ftp://ftp.command-hq.com/pub/command/avp, ftp://ftp.icomm.rnd.su,
         http://www.command-hq.com/command
Product: Antiviral Toolkit Pro (AVP)


Summary: resident and non-resident scanner and utilities


Cost  U$59.95 to U$200 for single copy, site licensing available

Rating (1-4, 1 = poor, 4 = very good)
      "Friendliness"
            Installation      2
            Ease of use       3
            Help systems      3
      Compatibility           3
      Company
            Stability         3
            Support           2
      Documentation           1
      System required         4
      Performance             4
      Availability            2
      Local Support           2

General Description:

AVP is a non-resident virus scanner with significant strength in dealing with
polymorphic and other viral programs using advanced techniques.  The package
also features a resident portion, heuristic scanning and utilities.

Please note that reactions from agents to the original review indicate that
versions of the programs vary greatly in price, features and documentation.


                  Comparison of features and specifications


User Friendliness

Installation

AVP now has a commercial system of distribution through agents.  I received a
copy of the US version from Central Command on two 1.44M disks.  Unfortunately,
although there is a installation program, there is no manual.  There are, in
fact, two setup programs, one to install an original version of the package,
and another to update it.  The installation process consists of copying and
decompressing of files, although the system startup files, CONFIG.SYS and
AUTOEXEC.BAT are analysed and can be amended during the procedure, and the
update process can find the original directory.

Ease of use

The programs are easy to run with a not quite standard CUA interface.  For some
reason the program attempts to use as a swap file a directory which is not
likely to exist on most systems, but the error message dialogue box allows
users to specify another.  The /TMP command line switch can be used to
circumvent this, but the explanation in the English documentation is in error
at this point.

Help systems

Context sensitive help is available.  An interesting feature is the
demonstration of sound or video effects of various viruses.

Compatibility

The program is particularly strong in detecting polymorphic viruses.

Company Stability

AVP is a stable product.

Company Support

The author is an active participant in the VIRUS-L discussion list.  Some sites
may have difficulty in sending messages to his Internet address.  Response,
however, is very good.  Distribution through national agents is significant.
Agents may not support or supply all components of the full package.

Documentation

The lack of a printed manual, especially after more than a year has passed, is
disappointing.  Even a card listing the installation steps would be an
improvement.  After installation a USERGUID.DOC file appears.  This contains a
lot of technical detail on the program, especially the virus database
structure, but no general discussion of the virus problem.

System Requirements

DOS 3.3 or higher, 580K free memory, and 16 file handles are stated to be the
minimum requirements in the documentation.  In testing, the program ran on a
machine with as little as 498K free memory.

Performance

AVP scores very highly in comparisons of variants detected, but is particularly
strong in detecting viral programs with polymorphic or other advanced features.
The program also has special functions for detecting infections in compressed
files or archives.

Both installation and operation are very slow, particularly on older machines.
On one XT it took over two hours to check 157 programs, 6 megabytes of a 20
megabyte hard drive.  On a turbo XT it took 13 minutes to check a floppy disk.
A 486 with a 350M hard drive took 19 minutes to scan.  The same machine took 36
seconds with TBScan and 99 seconds with F-PROT.  The cost in speed is a result
of the extremely thorough scanning.  No option for a reduced scan is available.

Local Support

None provided, but Internet response from various agents is good.

Support Requirements

Once installed, AVP is accessible to any level of user.  Intermediate users
should be able to handle installation.  The program has features which require
advanced knowledge in order to obtain full benefit.

                                 General Notes

AVP is, unfortunately, still not widely known or available despite increased
distribution.  The recent commercial distribution has restricted the
availability of the shareware version, but both older releases and a newer
"AVPLite" can be found at various sites.  For those serious about virus
protection, the package is worth the trouble taken to find it.

copyright Robert M. Slade, 1994, 1995   PCAVP.RVW   950921

======================
roberts@decus.ca   rslade@cln.etc.bc.ca   Rob.Slade@f733.n153.z1.fidonet.org
     "For every complex problem, there is a solution that is simple, neat,
                         and wrong."  -- H. L. Mencken
Author "Robert Slade's Guide to Computer Viruses" 0-387-94311-0/3-540-94311-0

------------------------------

Date: Fri, 12 Jan 1996 16:50:55 -0500 (EST)
From: "Rob Slade, the doting grandpa of Ryan Hoff" <roberts@mukluk.hq.decus.ca>
Subject: F-PROT Professional (Command Software) (DOS/Windows)
X-Digest: Volume 9 : Issue 20

PCFPROTC.RVW   950921

                    Antiviral Protection Comparison Review

Company and product:

Company: Command Software Systems
Address: 1061 E. Indiantown Road, Suite 500, Jupiter, FL   33477
Phone:   +1-407-575-3200, +1-800-423-9147
Fax:     +1-407-575-3026
Contact: Lance McKay, Sarah Gordon
Email:   lmckay@commandcom.com, sales@commandcom.com, support@commandcom.com,
         sarah@commandcom.com
Other:   BBS +1-407-575-1281
Product: F-PROT Professional (cf Frisk)

Summary: Resident and manual scanning, change detection

Cost: (varies)

Rating (1-4, 1 = poor, 4 = very good)
      "Friendliness"
            Installation      3
            Ease of use       4
            Help systems      3
      Compatibility           3
      Company
            Stability         3
            Support           3
      Documentation           3
      Hardware required       4
      Performance             4
      Availability            3
      Local Support           ?

General Description:

Scanning, resident scanning and disinfection capabilities, change detection
software and resident scanning.  Windows interface included.  (See also Data
Fellows product, this vendor's version is more basic.)


                  Comparison of features and specifications


User Friendliness

Installation

The full package was obtained from Command Software.  The product is shipped on
two writable but protected 1.44M disks.  A simple installation program is
included, but this does not cover installation of the change detection
component.

In the automated installation, VIRSTOP is installed to be invoked from
AUTOEXEC.BAT.  Those wishing to invoke it from CONFIG.SYS must do the
installation manually.

Ease of use

The user, by default, is presented with a graphical interface, but command line
switches are an option for those wanting more speed, or a standard invocation
for a large group of users.

Help systems

Online help is available.

Compatibility

See as for F-PROT version 2.xx.

Company Stability

See as for F-PROT.

Company Support

Phone, (800), fax, BBS, Internet, MCI mail and Compuserve support is provided.

Documentation

The documentation available from Command Software is very brief and contains no
general virus information.  It is clear as regards program operation.

Hardware Requirements

No special hardware is required.

Performance

See as for F-PROT 2.xx.

Local Support

Toll free telephone support is available in North America and Internet email
elsewhere.

Support Requirements
 
This product is recommended for unsupported environments.

copyright Robert M. Slade, 1993, 1994, 1995   PCFPROTC.RVW   950921
======================
ROBERTS@decus.ca    rslade@cln.etc.bc.ca    rslade@freenet.vancouver.bc.ca
"If you do buy a computer, don't turn it on." - Richards' 2nd Law of Security
Author "Robert Slade's Guide to Computer Viruses" 0-387-94311-0/3-540-94311-0

------------------------------

Date: Fri, 12 Jan 1996 16:51:49 -0500 (EST)
From: "Rob Slade, the doting grandpa of Ryan Hoff" <roberts@mukluk.hq.decus.ca>
Subject: McAfee Scan suite (DOS/Windows)
X-Digest: Volume 9 : Issue 20

PCSCAN.RVW   950921
                               Comparison Review

Company and product:

Company: McAfee Associates
Address: 2710 Walsh Avenue, Suite 200, Santa Clara, California,
         95051-0963
Phone:   +1-408-988-3832
Fax:                                   +1-408-970-9727
Email:   mcafee@aol.com, mcafee@netcom.com, support@mcafee.com,
         scott_gordon@cc.mcafee.com
Other:   BBS +1-408-988-4004, mcafee.com is IP 192.187.128.1
Product: Scan suite


Summary: scanning, disinfection and resident scanning modular suite


Cost: $25 - $35 US per program

Rating (1-4, 1 = poor, 4 = very good)
      "Friendliness"
            Installation      2
            Ease of use       3
            Help systems      2
      Compatibility           2
      Company
            Stability         3
            Support           3
      Documentation           2
      Hardware required       3
      Performance             2
      Availability            3
      Local Support           1

General Description:

SCAN is a boot sector, memory and file scanning program, with some
disinfection and change detection capabilities.  Disinfection is now
accomplished by a switch in the SCAN program.  VSHIELD and SENTRY are
resident file infection and activity checking programs.  A Windows
interface is also available.

FSHIELD, Sentry and VCOPY have been discontinued and are no longer
supported.


                  Comparison of features and specifications



User Friendliness

Installation

SCAN does not require installation as such.  All programs, however, are
distributed in .ZIP format and use PKUNZIP version 2.04G for unpacking
with authenticity verification.

VSHIELD is distributed in two, mutually exclusive, versions.  One
version requires the use of SCAN's /AV or /AF option, which adds an
authentication CRC check onto programs.  A second level of protection is
added in one version with file infection checking for known viral
programs.  The programs can also be used to prevent the running of
unauthorized programs.  VSHIELD must be installed "manually" by the user
in the AUTOEXEC.BAT file with all desired options and switches.
(Installation utilities are separately available from certain dealers.)

The distribution of SCAN as shareware has led to the "release" of many
"trojan" versions of SCAN.  McAfee Associates has attempted to deal with
the security problem in two ways: the use of the "authentic
verification" envelope on ZIP archives, and the VALIDATE program
produced by McAfee Associates itself.  Unfortunately, both methods have
problems.  The "-AV" codes have been "spoofed" by copies of PKZIP which
will add a code, not necessarily that of McAfee Associates.  More
recently, the security of the PKZIP "-AV" codes has been broken: it is
now possible to duplicate any code.  The VALIDATE code is more secure,
(although it has been cracked) but requires a knowledge of the
validation code from a "trusted source".

Ease of use

The SCAN program is fairly simple to execute, but provides for a very
large number of options in the form of software "switches".  These can
complicate the use of the program, but probably will not be used by most
users.  The base scanning function is simple to operate, and novice
users will probably not use any other functions.  (The one major
exception is the /AV option.  If used on a program that is already "self
checking" it will likely cause the program to terminate, and so must be
identified and removed.  The program has therefore added an /AF option
which will store the change detection information to a file rather than
appending to the program.)

Help systems

If SCAN is invoked with no specifications, it gives three "screens" of a
listing of the "command line switches".  This can also be obtained with
the /?, /H or /HELP switches.

Compatibility

SCAN and the other programs in the suite are updated frequently, and the
latest version should be able to handle almost all viruses that a user
would encounter.

Unfortunately, recent versions have seen a major decrease in the
accuracy of virus identification.  A number of scan strings have become
"generic", and will identify a number of viral strains.  Some of these
have been so identified (as "Gen_"): a number still report the name of a
specific virus regardless of the actual strain found.  Along with this,
there has been a corresponding decline in the ability of /CLEAN to
disinfect programs and disks.

Company Stability

McAfee Associates has been producing versions of SCAN for a number of
years, updating on a frequent but somewhat irregular basis.  SCAN is
probably the most widely used virus scanner in North America at present.
The company has recently "gone public" in order to expand into the
shareware utilities market, and is buying programs from other shareware
authors.

In the past year there have been major changes to both the corporate and
support structure of the company.  McAfee Associates now appears to be
concentrating on a position as a leading provider of network and
corporate utilities.

Company Support

The company appears to be trying to promote support through CompuServe
rather than other sources.

Documentation

The directions for use of the programs are restricted to listings of the
"command line switches".  They are clear in all cases, if somewhat
concise.  Novice users will find little conceptual information about
viruses, or specific information about the various viral programs that
SCAN will deal with.  The list of viral programs, VIRLIST.TXT, is no
longer included in the archive.

The documentation, while not quite alarmist, certainly strongly suggests
that the user, if any virus is ever found, should retain the services of
McAfee Associates or an authorized Agent.  Also, outside sources (such
as the Hoffman virus list) often state that viri can be dealt with by,
for example, using the "SCAN /D" option, without warning that this
merely deletes and overwrites the existing file.

Hardware Requirements

The only stated requirement is DOS 3 or higher.

Performance

SCAN now ranks as one of the slower scanners reviewed.  Note also the
loss of some accuracy in identifying individual viral strains.

Note that /CLEAN has come under increasing criticism for its performance
in removing infections, particularly in the area of BSI and MBR viral
strains.  Versions of the earlier CLEAN program tested (and MDISK) have,
in my own experience, occasionally left the computer or disk in a worse
state than the virus.

Local Support

Because of the very wide use, local support of SCAN is more generally
available.  The available version, however, is not always the latest, as
many users, in my experience, tend to use the one version they obtain
for at least a year before seeking another.

There are also a number of shareware products that "enhance" the use of
SCAN, such as menuing "front ends" or programs to assist in checking
archived files.

Support Requirements

If at all possible, it would be best if knowledgeable users assisted
with the use of SCAN.  The programs are simple enough to be operated by
a novice user, and no harm should result, but best results will be
obtained with the program if someone aware and informed of virus
operation is involved.

                                 General Notes

Version numbering, which has been problematic in the past, is now
standardized and explained in a file in the distribution archive.

copyright 1991, 1992, 1994, 1995 Robert M. Slade   PCSCAN.RVW   950921

======================
ROBERTS@decus.ca,   rslade@cln.etc.bc.ca,   rslade@freenet.vancouver.bc.ca
     "Information Superhighway" anagram - "When forming, utopia's hairy."
Author "Robert Slade's Guide to Computer Viruses" 0-387-94311-0/3-540-94311-0

------------------------------

Date: Fri, 12 Jan 1996 16:52:30 -0500 (EST)
From: "Rob Slade, the doting grandpa of Ryan Hoff" <roberts@mukluk.hq.decus.ca>
Subject: F-PROT version 2.xx (DOS)
X-Digest: Volume 9 : Issue 20

PCFPROT2.RVW   950925
                    Antiviral Protection Comparison Review

Company and product:

Company: Frisk Software International
Address: Postholf 7180, IS-127 Reykjavik, Iceland
Phone:   +354-5-617273
Fax:     +354-5-617274
Sales:   see Command Software, Data Fellows and SafetyNet; German version
         +49-40-6932033 or percomp@infohh.rmi.de
Contact: Fridrik Skulason, Vesselin Bontchev
Email:   sales@complex.is, support@complex.is
Product: F-PROT 2.xx Virus detection/protection/disinfection

Summary: scanner, resident scanner and disinfector

Cost: free for non-commercial personal use, Site license $1(US) per computer
(minimum $20), 25% educational discount

Rating (1-4, 1 = poor, 4 = very good)
      "Friendliness"
            Installation      3
            Ease of use       4
            Help systems      3
      Compatibility           3
      Company
            Stability         3
            Support           3
      Documentation           3
      Hardware required       4
      Performance             4
      Availability            3
      Local Support           2

General Description:

Scanning, resident scanning and disinfection capabilities.  The informational
utilities present in the earlier (1.xx) versions have been replaced by
heuristic analysis scanning.  Change detection and operation restricting
utilities have been removed and not replaced.  Highly recommended for any
situation.  Best "value for cost" of any package reviewed to date.


                  Comparison of features and specifications



User Friendliness

Installation

Installation is now added as a feature in the main program.  Manual
installation is still an option, and is likely the one most used by those
familiar with the program.  Since the program is shareware, and since
installation is little more than copying of files, unless VIRSTOP is installed,
it is unlikely to present any problems.

In the automated installation, VIRSTOP is installed to be invoked from
AUTOEXEC.BAT.  Those wishing to invoke it from CONFIG.SYS must do the
installation manually.

Ease of use

Except for resident scanning, F-PROT is now invoked from a single program.  The
user, by default, is presented with a graphical interface, but command line
switches are an option for those wanting more speed, or a standard invocation
for a large group of users.

There is no "help" key, but the options are fairly simple, and explained in
text boxes where necessary.

Help systems

There is no help per se, although a listing of command line switches is
available.

Compatibility

F-PROT consistently maintains the highest ratings in all independent tests of
scanning of known viral programs, including my own.  In terms of disinfection
capability, only Alan Solomon's Anti-Virus Toolkit and now KAMI's Anti Viral
Toolkit Pro has similar ratings.

Because of an external language file, F-PROT is available in at least six
languages, and can be readily translated into others.

The heuristic analysis portion of the program occasionally generates a "false
positive" alert about a program that is not, in fact, infected.  This is to be
expected from this type of scanning, and the incidence is much reduced from
when this function was first included with the program.  The heuristic analysis
feature has been generally effective in identifying new and "unknown" viral
strains, but is not perfect.  (Perfection is, of course, inherently
unattainable in this type of program.)  Indeed, the documentation for this
feature states that it is still to be considered experimental, and is very
conservative in its claims.  Programs known to cause false positives are
listed.

F-PROT may be run under Windows, but is not a Windows program.  This is planned
to be addressed in future, as are improvements for VIRSTOP to make it run with
Windows, and to check files as they are copied, to check floppy disks as
accessed, and to use EMS memory.

Company Stability

F-PROT was originally a sideline developed by Fridrik Skulason while he was
still employed by the university.  The acceptance of F-PROT as a highly
accurate scanner and effective disinfector have allowed the growth of Frisk
Software to a leading position in antiviral software.  The basic technology is
licensed by at least three other companies.  The most recent addition to the
company is Vesselin Bontchev, long considered one of the top independent
antiviral researchers.

Company Support

Fridrik Skulason is available through the Internet, and replies to queries can
be expected within a week or less.  As the program has become much more popular
with the general public, numerous people have requested his Fidonet address.
Unfortunately, frisk is not active on either Fidonet or VirNet.  Users of the
commercial version can obtain the "F-Prot Update Bulletin" from Data Fellows,
and may also be able to get text file copies from better antiviral archives.

Documentation

Being shareware, the package has no printed documentation.  The text files
included with the programs are very clear and thorough, and provide an
excellent primer on virus functions and protection, as it relates to scanning
and disinfection.  The large single USAGE.TXT file has been broken into smaller
"chapter" files, which allows for quicker access to a particular function or
feature.

As some of the other virus detection and prevention capabilities have been
dropped from the package, so the very excellent discussions of the different
types of antiviral software, and their strengths and weaknesses, have been
dropped from the documentation.  It is recommended that interested parties
obtain old (1.xx) versions of F-PROT for this material.

The virus information files previously contained in separate text files have
been included as a virus information feature within the main program.

Hardware Requirements

No special hardware is required.

Performance

During testing, FPROT has consistently identified more viral programs than the
"current release" of any other product.  FPROT is generally slower at scanning
because of the multiple signatures being used to check for each virus, but is
not the slowest scanner tested.

The user is in control of FPROT at all times, with the exception that VIRSTOP
will not allow the boot sequence to continue in the case of a boot sector
infection at startup.

FPROT, in seven years of my testing, has not given a false positive alarm on
any normal program, nor has it interfered with any normal program operation.
Users have, from time to time, reported false positives but these are generally
with less well known programs and are often fixed within a week.

The various functions and utilities that have been dropped from the 2.xx
version programs still have significant value.  Serious virus researchers and
consultants would do well to obtain copies of older (1.xx) versions.  These
have been retained, and are available, at better antiviral source sites.

Local Support

Since FPROT is shareware, there are no local dealers from which to obtain
support.  Knowledgeable users are, though, fairly common.

FPROT is also available as a commercially distributed product or as part of
other security products.

Support Requirements

Very little support should be needed for this program.  On occasion assistance
my be needed in disinfection, or in positively identifying a new viral strain,
but no product tested deals with this situation better than F-PROT.

                                 General Notes

Because of its "shareware" distribution, F-PROT is best compared against
McAfee's Associates SCAN program.  F-PROT is kept up to date with regular
additions to the signature file, and constant improvements to the program.
SCAN versions are released at approximately the same frequency as FPROT, but in
two and a half years FPROT releases consistently identified more viri, and with
greater accuracy than did the "same level" releases of SCAN.  SCAN also needs
to release far more "bug fix" versions than does F-PROT.  Fridrik Skulason
publishes fewer signatures of new viruses on the VIRUS-L/comp.virus
distribution lists than he used to, but some others are supplying appropriate
signature strings in his format.  F-PROT is significantly cheaper than the SCAN
suite as well, and is complete in one package, although the SCAN suite in total
now offers some edge in utility.

I am personally sorry to see that the former utilities are not included in the
current package.  However, it is unarguably simpler for novice users to install
and use the newer package, free from the confusion of the multiplicity of files
contained in the previous version.

F-PROT is sold commercially by SafetyNet, under the name VirusNet, and as
F-PROT Professional by Command Software and Data Fellows.  VirusNet is very
similar to the original product, while F-PROT Professional has additional
features added by the different vendors.

copyright Robert M. Slade, 1990, 1992, 1994, 1995   PCFPROT2.RVW   950925

==================
Vancouver          roberts@decus.ca         | This space
Institute for      rslade@cln.etc.bc.ca     | intentionally
Research into      rslade@vanisl.decus.ca   | *not* left blank
User               Rob_Slade@mindlink.bc.ca |
Security           Canada V7K 2G6           |


------------------------------

End of VIRUS-L Digest [Volume 9 Issue 20]
*****************************************


