Alamo PC Organization: HOME > PC Alamode Magazine > Product Reviews

cat

Norton AntiVirus for Windows 95 
Software Review by Mike Bianchi

Norton Anti-Virus LogoVIRUS ALERT!! Have I got your attention? Is the adrenaline pumping? There is probably nothing more effective than a virus to strike fear into the hearts of computer users.

But what exactly is a virus? A virus is a program that attaches itself to other programs; when those programs are run, the virus activates and attaches to other programs. Computer viruses, like their biological counterpart come in many varieties. Some do nothing more than replicate themselves; one that was prevalent about 5-6 years ago did nothing more than change the volume label on the disk it was attached to and occasionally posted a message on the screen that said, in effect, "See what I can do". Others, again to use the biological analogy, can be particularly 'pathogenic', damaging or deleting files or even completely reformatting your hard drive. 

 Here are a few points to keep in mind about viruses 

  • Point 1: Although viruses are usually spread accidently through the carelessness or ignorance of the user, their origination is never by accident. They are created by malicious programmers with the specific intent to cause problems on other people's computers. I have my own ideas as to what should be done with people like that, but a family oriented magazine like this is not the place for that discussion. 
  • Point 2: Viruses are spread by attaching themselves to executable program files or, in some of the more recent developments, to program documents or macro files, particularly Microsoft Office files and macros. I am not aware of any viruses that can attach to document or macro files for programs other than Office, but if they don't exist, its only a matter of time before someone figures out how to do it. The point of this discussion is that a virus cannot be spread through a text document such as an Internet news group article or an e-mail message (be cautious of attachments, though). It seems the newest fad for some of the 'Net-Sickies' to get their jollies is by spreading false virus alert warnings.

  • Point 3: Viruses can cause problems only if you don't know how to deal with them. 
So, how DO you deal them? I'm glad you asked me that. Let me tell you about a product that is designed specifically for that purpose. 

Norton AntiVirus for Windows 95, version 2.0 is a product of Symantec Corp of Cupertino CA. The Win95 version will run ONLY in Win95. Symantec also produces separate versions of Norton AntiVirus for DOS, Windows 3.x, NT, NetWare, and Macintosh. 

A check of local vendors gives a price range of $70-85. Mail order prices range from $65 to $90. 

Symantec's web site is located at http://www.symantec.com; customer service can be reached at (800) 441-7234 in the US and Canada. They are also available in Australia, Mexico, Brazil and several European locations. 

Tech Support

A phone call to tech support revealed that they are under staffed. It took about 5 minutes to navigate through their voice mail system which gives recorded messages about some common installation problems. Once getting through that system, I was placed on hold in order to talk to a real person. After waiting 12 minutes, I got a recording saying that there were 15 calls queued and that the longest had been waiting 42 minutes. At that point I gave up and decided to hang up; it's not a toll free number. 

System Requirements

Minimum system requirements are an IBM PC or 100% compatible, 386DX, with 4 Mb RAM and 12 Mb disk space running Windows 95. Recommended requirements are a 486DX or higher processor with at least 8 Mb RAM. I tested it on a 166 MHZ Pentium with 16Mb RAM, Windows 95 and about 600 Mb of free disk space. 

Installation:

Installation on my system took 9 Mb of disk space and 32 minutes including time to read the information and instruction screens. I selected the default configuration. 

I'm one of those weird people who actually reads the documentation, but the installation instructions could not be found anywhere in the User's Guide. I finally found them on the separate QuickStart card. However, if you have ever installed any software in Windows 95, you won't need the instructions. You simply select your preferred method, from the several provided by Win95, to execute the SETUP program on the first disk. 

The first step of the installation process is an automatic scan to make sure you don't already have a virus on your system. If you know for sure that you do already have a virus infection, the QuickStart card gives instructions on how to remove it before installation of Norton AntiVirus. 

The installation recognized that I was using Netscape Navigator and set itself up as a Helper Application. It did not recognize that I also had four other web browsers installed; it has to be configured manually for use with these browsers. The instructions for manual configuration are included in a text file on the disk. 

Features:

Norton AntiVirus for Windows 95 offers several lines of defense against computer viruses. For most users, the default settings configured by the installation program will be all that you need. The User's Guide includes a Risk Determination test to help you determine the best configuration to provide protection customized to your own working habits. 

Manual Scans: You can tell Norton AntiVirus to check for viruses whenever you wish with the manual scan feature. You can select specific files, folders or entire disks to examine. 

Scheduled Scans: Norton AntiVirus includes an event scheduler that can be used to run a scan at a predetermined time. By default, the installation program schedules a scan to be run weekly. If you have Microsoft Plus! you can also use the System Agent to run a prescheduled scan. 
 

Startup Scans: By default, Norton AntiVirus is configured to run a scan every time you turn your computer on. This is the best way to detect viruses that infect your system files and boot records that the computer needs to run. 

Auto-Protect: This feature runs in the background and scans files as they are used or copied. 

There are thousands of known viruses. They function by adding pieces of code (known as the virus signature) to the infected file. Scans work by searching files and memory for the signature. This is done by comparing files against the Virus Definition File which contains all the known signatures. However, with 3-4 new viruses being created EVERY DAY, it is possible that the virus you picked up is not even included in the Definition File yet. Norton AntiVirus's Auto-Protect includes a feature known as Virus Sensor that is capable of identifying the presence of unknown viruses by monitoring your system for 'virus like activity', that is, the type of activity that a virus would use to infect or damage a file, such as trying to format your hard drive. 

Inoculation: Once you know that you do not have or have gotten rid of any viruses, the Inoculation feature adds another line of protection. This records critical information about a file that future scans can use for comparison. If the file has been changed so that it does not match this 'fingerprint', you will be notified as this could indicate the presence of a virus. It is important to remember, however, that an Inoculation discrepancy can be also caused by events that are not related to a virus. For example, installing a version upgrade will probably cause an Inoculation error report to be generated. 

So What Happens If a Virus Is Found:

What Norton AntiVirus does when a virus is discovered depends on which feature made the discovery. If a virus is found during a manual or scheduled scan, the Norton AntiVirus Repair Wizard appears at the end of the scan, or if you prefer, can be configured to appear immediately. If the virus is detected during a Startup Scan or by Auto-Protect, all processing is immediately stopped and a warning screen is presented, this screen is in text mode because even display processing is halted. 

The Repair Wizard can be configured to repair files manually one at a time or automatically (recommended). The automatic setting will ask for confirmation before taking any action. The options available are: 

     
  • REPAIR removes the virus and returns the file to its original state. 
  • DELETE removes the file from the disk. Deleted files cannot be recovered and will have to be reinstalled or restored from an uninfected backup. You did make a backup didn't you? 
  • STOP blocks the reported action from taking place. This option may prevent a virus from spreading but does not solve the problem. 
  • CONTINUE allows the reported action to take place. This should be used when the action that is being reported is valid in the context of what you are trying to do. For example, if Auto-Protect tells you that a program file is being overwritten while you are running an upgrade installation. 
  • EXCLUDE excludes the file from future scans and allows the operation to continue. This option should be used with caution only if you know that it is not a real problem and would expect the alert to pop up again. 
  • INOCULATE adds or updates the file's inoculation data. Changes in the inoculation data would occur normally during an upgrade installation, at other times may indicate the presence of an unknown virus. 
  • INFO displays detailed information about the virus that was found. 
System files cannot be deleted. If they cannot be repaired, you will need to shut off the computer then reboot from an uninfected floppy; either the rescue disk created when you installed Norton AntiVirus, the Startup disk created when you installed Windows or a boot disk created from DOS 3.1 or higher. Be sure to have one of these disks created BEFORE your system becomes infected and that the disk is write protected when you use it. Once your system has been rebooted, you will need to reinstall Windows. Unrepairable boot records can be restored from the rescue disk. 

Updates

As I mentioned earlier there are an average of 3-4 new viruses developed every day. Keeping ahead of the game is a never ending task. Symantec updates their Virus Definition file at least once a month and it is available from several sources. 

A feature called Live Update will connect you through your Internet connection or modem, down load the file and automatically install it on your system. I tried the Internet feature and was unable to get a connection through my ISP, it probably requires a direct connection but I was unable to get confirmation of that (see my comments above on tech support). If you use the modem option, expect to find a call on your phone bill to Eugene OR. The file can also be obtained from Symantec's BBS or from our own, from America Online, CompuServe, Microsoft Network, Internet or though the mail. I downloaded it from Symantec's FTP site and before I got the usual Win95 SaveAs window, Norton AntiVirus popped up a window informing me that it had determined that the file was virus free, a nice touch. 

Evaluation

I put Norton AntiVirus through the paces using the EICAR test virus. EICAR is not really a virus, it is a standardized test for antivirus programs that was developed by the European Institute for Computer Antivirus Research. Although EICAR does not have any of the properties of a virus (i.e. it does not replicate or attack files), it is included in the Virus Definition File and so will trigger all of the virus alert warning features. To create this 'virus', enter the following string in Notepad: 
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H *
then save it to any filename with a .COM extension; if you are using Windows 95 be sure to enclose the filename in quotes or it will automatically be given a .TXT extension. 

Results

I was not allowed to create the test file. My attempt to create the COM file as outlined above was blocked by Auto-Protect. I had to disable Auto-Protect in order to save the file. Once the file was created and Auto-Protect enabled, attempts to execute or copy the file resulted in the same interruption. 

Rebooting the computer to activate the Startup Scan gave similar results; the problem file was located, the boot procedure was halted and I was presented with a text screen to determine how to deal with the situation. A second reboot after the infected file was moved out of the root directory missed it entirely. The Startup Scan is designed to catch viruses that infect system files and boot records, as such, it only examines executables in the root directory and WIN.COM. 

Running the Manual Scan feature, the virus was located as expected and the Repair Wizard was activated. Attempting to repair the file resulted in a message saying that the file could not be repaired and recommended deletion. This makes sense because, as discussed previously, the Repair function removes the virus and returns the file to the state it was in prior to infection. In the case of my test file, the virus was the entire file and removing it would have left nothing. Since a real virus would function by replicating itself to infect additional files, I next ran a scan with multiple copies of the file scattered around to different folders. All copies were located with the same options being offered for each as were available with the single copy. 

The next test I ran was to check Norton AntiVirus's performance on compressed files. I compressed the file using PKZIP. Again the procedure was blocked by Auto-Protect (as was decompressing). Although the Scan was able to locate the virus and report the name of the compressed file where it was located, it was unable to repair or delete the file while in the compressed state. 

The final test was to transfer the file through the modem. Once again Auto-Protect saved the day by detecting the virus and terminating the transfer. However, the problem file was missed completely when the zipped file was transferred and the transmission was completed without any alert being triggered. This is the closest thing that I found to a negative result to any of the tests I ran. Although I think it would be a handy feature to be able to detect viruses in compressed files as they are being transferred, this is really not much more than an inconvenience because all downloaded files are manually scanned before they are used anyway (aren't they?). 

Conclusion

Protecting your computer against viruses requires constant vigilance. With Norton AntiVirus the battle can take place behind the scenes, freeing your computer and your time for more productive tasks. I have used other Symantec products in the past and have always been happy with them. However, even I was surprisingly impressed with the powerful performance and ease of use of Norton AntiVirus. I strongly urge that all of you have some kind of virus protection on your computer. When selecting antivirus software I recommend that you give serious consideration to Norton AntiVirus. 

 Mike Bianchi is a database analyst, programmer and system administrator and has been an involved member of Alamo PC since 1992.