NetNews Usenet Archive 1992 #27/NN_1992_27.iso/spool/comp/virus/4346

Internet Message Format | 1992-11-18 | 14.3 KB

Path: sparky!uunet!charon.amdahl.com!pacbell.com!iggy.GW.Vitalink.COM!cs.widener.edu!dsinc!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: [e-mail]
Newsgroups: comp.virus
Subject: Review of Integrity Master (PC)
Message-ID: <[e-mail]>
Date: 7 Nov 92 07:42:20 GMT
Sender: [e-mail]
Lines: 291
Approved: [e-mail]



PCIM.RVW   920930
                               Comparison Review

Company and product:

Stiller Research
2625 Ridgeway St.
Tallahassee, FL  32310
[phone]
Advanced Support Group (ASG) at  1-900-88-HELP8 (1-900-884-3578)
or 314-256-3130
[e-mail]
Runway BBS [phone]  2400 baud
           [phone]  HST
           [phone]  V.32
Integrity Master change detection software 1.24

Summary: Change detection program with built in signature scanner

Cost: $35, licensing available

Rating (1-4, 1 = poor, 4 = very good)
      "Friendliness"
            Installation      3
            Ease of use       3
            Help systems      3
      Compatibility           3
      Company
            Stability         2
            Support           3
      Documentation           3
      Hardware required       4
      Performance             3
      Availability            2
      Local Support           1

General Description:

IM is a change detection program with built in scanner.  SETUPIM is an
installation and tutorial program.  Also included are a file viewer, printer
and utilities to check the efficacy of the system.

                  Comparison of features and specifications



User Friendliness

Installation

Integrity Master is distributed as shareware, and Stiller Research is a member
of the Association of Shareware Professionals.  The distribution files for
Integrity Master are full of files, a large number of which relate primarily to
the distribution and description of the program.  The number of files is
somewhat daunting, as is the size of the README.DOC file.  The file does,
however, start with the suggestion that the novice simply run the SETUPIM
program, and this is worthwhile advice to follow.

I received also a version on disk from the developer.  The disks (both sizes,
low density) arrived unprotected on writable disks.  However, a write protect
tab was stuck to the casing of the 5 1/4" disk, and the package did show
evidence of being tampered with en route.

Calling SETUPIM an installation program is misleading.  It is less than an
installation program -- and much, much more.  For the novice user, SETUPIM has
some of the most "user-friendly" features of any product yet reviewed.  It
certainly has the best explanations of the antiviral process and the options
for security of any installation program.

I have some quibbles with it, but only by virtue of the fact that it is so good
I am surprised that some additional features are not included.

The programs (both IM and SETUPIM) have a command line switch that "forces"
monochrome mode with a monochrome monitor on a "colour" adapter.  This is
important, since some of the menu "highlighting" is invisible on a monochrome
monitor.  The programs *can* change to monochrome in "mid-session", so it
should not be difficult to add a short "screen test" for the completely novice
user, rather than making them use the command line option.  (This applies only
to SETUPIM: a proper installation will tell IM which video mode to use.)

(If IM is invoked before SETUPIM is run to create the parameter file, IM will
refuse to run.  Three options are presented, including "Abort" which is
described, with an unusual lack of clarity, as "Quit and return".)

The SETUPIM program prepares a parameter file for use by IM (which sets up the
various options for running the integrity checks), and produces a suggested
procedure for completing the installation, but it does not actually do the
copying and placement of files, or the invocation of the initial "signature"
calculations.  While readily admitting the value of having a "cold boot" before
this is done, it should be possible to do some more of this for the novice user
before turning him loose with a (softcopy) instruction set.  Alternately, the
installation program could strongly suggest that a "cold boot" and other
security measures are desirable, but offer to proceed with installation if the
user desired, on the clear understanding that this is "second best".  (This
approach is taken with some of the options during the setup.)

This is not to say that the instructions in the IMPROC.TXT (the suggested
installation procedure document file produced by SETUPIM) are in any way
inadequate.  The instructions are clear and straightforward.  The file is
displayed to the user at the end of the SETUPIM part of the installation
process, and the user is given the command to invoke the IMVIEW file viewer in
order to review the file later, or the IMPRINT batch file in order to print it
in hardcopy.  (The IMPROC.TXT is unclear at one point, the one where almost
everyone seems to fall down.  The document contains the injunction to "cold
boot" the computer, and it is probably not clear to the novice user that this
does not mean to do it "right now".)

The SETUPIM program also contains a tutorial.  Both the operation of the
program, and the conceptual aspects of virus protection, data loss and security
measures are covered.  This is extremely useful, and the only problem I have
with it is to wish that some more of the material from the documentation could
be included.

The installation procedure does not address installation of IM in the
AUTOEXEC.BAT file, although use of scheduling software is mentioned in places.
The installation process does, however, suggest the preparation of a bootable
disk with IM files on it for recovery purposes.  It even prepares a CONFIG.SYS
file to be placed on the diskette.  To my astonishment, I found that this
contained a "DRIVPARM" command necessary for my "aftermarket" 3.5" drive to be
recognized as such, correct down to the proper number of "^A" characters which
have to be inserted.  (When I got the drive, it took me three months to find
the right command for this drive and DOS version.)

Ease of use

The screens, menus and options are well laid out, and labels are well chosen
with a view to clarity of meaning.  The SETUPIM program is amazingly well
designed with the novice user in mind.

The program is not perfect: at one point, while the program checks the drives,
the user is left staring at a blank screen and possibly wondering if he did
something wrong.  (The amount of time this takes, however, varies widely
depending upon the speed of the machine.)  At another, the program is stepped
(or "timed") through a sequence which begins to suggest the possibility of an
infinite loop.  (The "timed" stepping is probably a good idea here; some users
may give up before it reaches the conclusion.)  The tutorial, at certain
points, requests specific keystrokes but accepts anything, not a pedagogically
sound design.  Some minor keystroke "trapping" and a "please press the arrow
key, you can practice later" message would improve it.

The tutorial is also somewhat misleading at points.  ESC is described as the
"get outa here" key: in IM it returns to the next higher level, but in SETUPIM
it returns to the previous section of the installation procedure or tutorial.
Also, the tutorial mentions the "Alt-X" option to abort without pausing.  While
it does mention that this is disabled in SETUPIM, use of the key within that
program may "hang" the computer or cause unpredictable behaviour.  (Likely a
bug, and one that seem limited to XT level machines.)

However, the GUI, windows and menus are here used as they are meant to be in
order to make the program useful and quick to operate.  Not only is the label
and option wording well chosen, but each item, as it is selected, pops out a
window with extra explanation about what it does.  Often the window will
contain a brief, but clear, discussion of the pros and cons of using this
particular option.

Help systems

Help is only partially context sensitive.  The help key, however, brings up
options for help with the operation of the program, the screen display, or a
help index.  (If the index is chosen, the currently "open" menu is "selected".)

However, the explanatory "window" beside each selected item seems to largely
obviate the need for any kind of help system.  (On items where the explanation
could be confusing, for example the "Files to iNitialize" options, the help
index is of little assistance, and one would need recourse to the manual.  The
index is, however, very extensive, even covering what the AUTOEXEC.BAT file is,
although with less detail than a novice would need in order to automate
checking.)

Compatibility

The use of the APPEND, SUBST and ASSIGN commands is recommended against by the
developer.

Company Stability

The HISTORY.DOC file shows the first release of Integrity Master in late 1991.
However, membership in the ASP and the provision of independent (if pay-per-
call) support for non-registered users, as well as active participation on
Fidonet (if not so active on Internet) bode well for the future of the product.

Company Support

As noted, telephone support is available through a pay-per-call number.
Registered users may call direct for support, and it is available through at
least two BBSes, and the Fidonet VIRUS and VIRUS_INFO "echoes".  Internet
correspondents, through the Compuserve address, have reported dissatisfaction
with the timeliness of responses to requests.  (In the preparation of this
review, I usually had next day response on email.)

(Note that ASG is completely independent of Stiller Research.  Stiller Research
does not receive any of the charges for support provided through ASG.)

Although distributed through ASP and VIRNet channels, there have been
substantial delays in getting up to date versions at ftp sites.

Documentation

Integrity Master's documentation is a massive text file, which begins with a
section intriguingly titled "Don't Read This".  This is, in fact, a suggestion
to novice users that they skip the first section, on the workings of I-M, and
just use the installation program.  It also suggests that they *do* read the
second section, which is a general treatment of viral programs and the various
other types of data disasters which commonly occur.

The documentation could use a good solid proofreading.  It contains a number of
typos and mistakes of various types.  Not enough to make one question the
"integrity" of the product, but enough to be startling as one reads through it.

The current printed documentation is basically a hardcopy of the text on the
disk, and shows a similar slightly amateur tone.  However, I am informed that a
new version of the documentation is currently at the printer.

The documentation as a whole has a "technical" flavour, but is clear and
unambiguous.  The intermediate user should have no problem with the first
section, but might be well advised to read section two first, in order to have
a clear grasp of the reasons for the various options IM offers.

Section two's overview of viral programs and other risks to data contains
excellent information, although the juxtaposition of certain sections is a bit
jarring.  However, it could form the basis of a very useful primer on data
integrity as a whole.

Hardware Requirements

A minimum of 220K memory and DOS 2.x or higher is required.  Refreshingly, a
hard disk is not.  It appears that IM can be installed on any disk that has
room for the programs and files.  In fact, IM can be installed on a hard disk,
and then the IM.EXE and IM.PRM files copied to a floppy and used anywhere.  IM
does not "demand" the presence of the equipment it was originally installed on.

Performance

Installation and calculation of signatures for the full hard disk was faster
than for other tested change detectors.  Interestingly, subsequent "check" runs
were not particularly faster on the test machine.  (This was an older XT,
faster CPUs may give IM more of an advantage.)  IM states that its "quick
check" looks only for changes to the file date and size.  It is likely that the
"turbo" mode of other change detectors do the same, without being as honest
about it.

(With all the information presented onscreen each time an option is selected,
it is remarkable that IM is extremely responsive.)

The storage of "signatures" is a matter of much debate.  IM stores them in each
directory checked.  There is, however, provision for storage of the signature
files on an "offline" diskette, which adds a security factor.

IM's virus scanning picked up all common viral programs tested against it, and
a good many that were less so.  Some new viri were detected on the basis of
similarity to known code.  (Note that IM does not "name" a virus if the fastest
option is used.)

Local Support

None provided.

Support Requirements

As with any change detection program, assignment of causes to different types
of alterations may be problematic.  However, the program itself should provide
ample explanation to any reasonably intelligent person, regardless of the level
of "computer" background.  The integrated virus scanner should be of great
assistance with identifying the most commonly seen viral programs.

                                 General Notes

Recommended as the change detection component of virus detection or protection
for all levels of computer users.

The product is still under very active development.  Hopefully the "rough
edges" will be eliminated as time goes on, allowing more of the essential
thoughtfulness of the product to be appreciated.  For a product which is
"officially" less than a year old, Integrity Master shows a remarkable
maturity.  Personally, I hope to see the addition of a "generic disinfection"
feature in the future.

As usual, Wolfgang Stiller has had an opportunity to review the draft form of
this evaluation.  His reaction has been very positive, and he suggests that the
issues raised here will be addressed in the near future.

copyright Robert M. Slade, 1992   PCIM.RVW   920930

==============
Vancouver      [e-mail]         | Slade's Law of Computer
Institute for  [e-mail]      |        Literacy:
Research into  [e-mail]         |   - There is no such thing
User           [e-mail]         |     as "computer illiteracy";
Security       Canada V7K 2G6           |     only illiteracy itself.