PCVDS.RVW 920911 Comparison Review Company and product: VDS Advanced Research Group P.O. Box 9393 Baltimore, MD 21228 (410) 247-7117 e-mail: tyetiser@ssw02.ab.umd.edu VDS 2.1 change detector and scanner Summary: Change detection with emphasis on hard disk system area protection Cost: $25 for single user, many other options Rating (1-4, 1 = poor, 4 = very good) "Friendliness" Installation 2 Ease of use 3 Help systems 1 Compatibility 1 Company Stability 1 Support 1 Documentation 2 Hardware required 2 Performance 2 Availability 2 Local Support 1 General Description: VDS is change detection software with hard disk boot sequence protection features. VDSFSCAN is a scanner which appears to be merely an adjunct to the change detection program. The installation procedure is obviously concerned with detecting and avoiding pre-existing viral infections, particularly of boot sector viral programs. VITALFIX is an MBR saving/repair program. Comparison of features and specifications User Friendliness Installation VDS was originally announced as shareware. Disks were shipped to me from VDS Advanced Research Group, along with a printed version of the documentation which is shipped with the shareware archive. I initially received a copy of version 2.0, and later a copy of 2.1. Along with the manual, but not bound in, was a single sheet "VDS 2.10 Installation Guide". Some references in this document, and in the manual itself, seem to indicate that the normally distributed shareware version does not have the full set of features of the package, but these passages are unclear and open to other interpretations. In any case, I am not sure of which of the seemingly many possible "versions" (trial, registered, complimentary, personal, academic, charity or business) I have reviewed, nor what the differences were. (In response to the initial draft of the review, I was told I had received a registered version but the differences were not explained.) Installation is a manual process. That it cannot easily be fully automated is obvious from the fact that the system must be "cold booted" at least twice during the process. The procedure is lengthy, but carefully explained. There are some points at which a familiarity with DOS would be of assistance in understanding some options, but this should not present a problem to a reasonably intelligent person. The instructions in the manual are quite clear, but the files presented on-screen at parts of the installation process are less so. At one point the user is directed to re-boot the computer: this is not what is desired. The instruction refers to the re-booting that should have taken place earlier, but this may not be clear to a novice user. Once the last part of the installation starts a windowed screen is presented. There is little for the user to do at this point, so the reason for the interface or display is unclear. Certain parts of the installation instructions seem to indicate, to the knowledgeable user, that the MBR is replaced: this is never confirmed. There is also no "uninstall" procedure listed. At a later point in the documentation, the possibility of saving, backing up or replacing the MBR with the VITALFIX program *is* discussed, but there is still no confirmation or denial of any modification during the installation process. The VDS documentation does state that the drivers installed remove themselves from memory after checking, and this appears to be true. Testing of installation seems to indicate that no modification is made to the MBR. (This was confirmed in the response to the draft review.) Installation should take about half an hour, or perhaps slightly less with practice. The last stage, that of "checksumming" each file, took eight minutes on an XT with a 20 meg hard disk. Installation must be done individually: a driver is customized for each machine, and, presumably, drivers could only be compatible if the BIOS, memory and disk partitioning is identical between machines. Ease of use The VDS program presents a "windowed" interface, but there are, in fact, no user options on it. The only options are in the command line switches used on invocation. About the only useful options in the command line switches are those for either more speed, or more thoroughness in verification. Note that if one wishes to use the "turbo" mode for initial checking at boot time the command line switch must be manually added to the entry in the AUTOEXEC.BAT file. VDSFSCAN, on the other hand, does have menu options, but does not have any command line switches listed in the documentation. (In response to the draft review, I was told that it does have command line switches; these can be listed with the /? switch.) Therefore, there is no possibility of, for example, disabling memory checking, or speeding up the scanning process. Help systems None provided. In fact, VDSFSCAN does tell you that help is available through the F1 key: the F1 key does nothing perceptible. (This is disputed by the developers. F1 is supposed to provide "context sensitive" help. However, in testing it did not.) Compatibility VDS is incompatible with "disk expansion" software, and certain other similar programs. This is seen by the developers as unavoidable. Company Stability Unknown. Company Support For product support, only the postal address is given. Although a phone number is given in the documentation, it is specifically restricted to software orders only. Documentation The original documentation for VDS 2.0 was very flippant, and resulted in a very negative reaction to the product from some quarters. In particular, the version 2.0 documentation made very negative comments about other (unnamed) antiviral products. The version 2.1 documentation is more serious in tone, but some passages are best understood in light of possible reaction to earlier negative comment. There are sections identified as "meant to be funny" and some remarks that "sensitive individuals should skip this section". The "VDS Risk Factor Analysis Test" is one of the sections that has been criticized. I feel this criticism is unwarranted. The test, while not perfect, does give a reasonable measure of risk, and has not been attempted before at this level. The documentation, overall, is best described as "patchy". Although the grammar is improving, and the tone is generally very readable, there is little substantive material. An initial reading left me wondering whether I had missed some section explaining the use of the program. While the manual protests that the information cannot be revealed without jeopardizing the security of the system, this seems to have been taken to extremes. However, there are nuggets of knowledge interspersed throughout the manual. Hardware Requirements MS-DOS 3.x or higher, must be installed on hard disk, and in specified directory, cannot be used with "drive expansion" software. None of the programs, in fact, will run "uninstalled", and so they afford absolutely no protection to "floppy only" systems, or LAN stations with no local hard drive. One of the disk files seems to indicate that VDSFSCAN can be run on any system: this is not true. A possible alternate explanation is that it may work on some of the drives that VDS is not normally compatible with. However, since the programs do not appear to work if not installed as directed, this would seem to be moot. (The developers protest this section, and say that VDSFSCAN will run not only uninstalled, but will run on a "single floppy" system because the entire program can be loaded into memory and other floppy disks can be scanned when the program disk has been removed. This is an advantage, and one which some scanners lack. However, my own observation is that VDSFSCAN will not run unless it has been installed, but that it can then be copied to a floppy and used on a floppy only system. This still means that one must have a hard disk to install the program onto, before it can be run on other systems.) A "known clean" MS-DOS system disk with MS-DOS files is also required for the installation process. Performance The initial verification at boot time adds two minutes to the boot process on an XT with a 20 meg drive. If the "turbo" switch is added manually, the results are significantly faster. VDSFSCAN is able to detect most common viral programs. A fairly large number in the test suite were missed, including all examples of Washburn programs used. A large number of those infections detected were misidentified. However, as disinfection appears limited to erasure, this need not be a problem. (The "cure" option of VDS appears limited to system areas of the disk.) Scanning is definitely only a sidelight for this package. Local Support None provided. Support Requirements The package, while seemingly aimed at the novice user, still would require at least an intermediate level knowledge of MS-DOS. Even at that, a thorough reading of the manual would seem to be in order. General Notes The installation procedure for VDS appears to be directed at the novice user who may already be infected with a virus. The attempt is laudable, and may provide additional security to the process. However, certain aspects of the implementation still require significant work. The program is recommended for intermediate users as having a strong detection component to add to other antiviral measures. Reaction to the draft review elicited the information that some of the problems mentioned in the review are now being addressed, particularly that of being able to schedule checking of the disk. Mention was also made of plans to release a commercial version of VDS. copyright Robert M. Slade, 1992 PCVDS.RVW 920911 ====================== roberts@decus.ca rslade@vanisl.decus.ca Rob.Slade@f733.n153.z1.fidonet.org Frequent advice to Internet newcomers: State your business, avoid eye contact, leave quietly, and no one gets hurt. Author "Robert Slade's Guide to Computer Viruses" 0-387-94663-2 (800-SPRINGER)