From: TYETISER@ssw02.ab.umd.edu (Tarkan Yetiser)
Newsgroups: comp.virus
Subject: Re: New Anti-viral ... (PC)
Date: 10 Apr 92 19:44:11 GMT


   Hello,

 bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:

> Subject: Re: New Anti-viral Product Announcement (PC)
>> TYETISER@ssw02.ab.umd.edu writes:

 >         New Anti-viral Package Featuring Real Intelligence,
 >                          not Artificial

>> Sigh... It sounds pretty tempting, like an anti-virus programs
>> everybody would like to have, but unfortunately, it seems more like
>> and April Fool joke to me...

   He, he, he, the joke is on you Vesselin. This thing is for real, and
everyone is invited to try it at their convenience.

 >    Description: VDS (Virus Detection System) 2.0 is an anti-viral
 > software package designed to contain the spread of computer viruses
 > providing early detection and quick recovery. What distinguishes VDS
 > from other anti-viral products is that its operation is based on
 > analyzing viral behavior rather than just looking for known byte
 > sequences extracted from virus samples. Therefore, VDS does not
 > require frequent upgrades.

>>  A heuristic analyser? Beurk... I would prefer something more
reliable.

   Nope, not a heuristic analyzer, just a humble integrity checker plus
some other useful tools.

 >    VDS uses a proprietary triple-pass verification technique to catch
 > the most evasive "stealth" viruses even when they are active in

>> I fail to see why a triple memory scan is needed. Any stealth virus
>> can be caught in memory with a simple one-pass scan. They are stealth
>> in files, not in memory you know...

   Maybe we mean something different when we talk about "verification".
We do not scan memory at all!  Stealth in files?  What does that mean?

 > optimized internal cache), VDS represents the strongest software
 > solution currently available.

>> Nope... When speaking about strong solutions, nothing that doesn't
>> involve integrity checking does not sound strong to me...

  Agreed. Its emphasis is on integrity checking as it should be.  Sounds
like you have not had a chance to look at the package. Too busy with
sorting out the cute virus names?

 >    VDS generates a customized device driver during installation. The
 > device driver barely adds three seconds to bootup time and catches
 > system infectors with ease. It can recover vital system areas such as
 > the master boot record and the partition boot record automatically,
 > and place a copy of the affected area in a file so that the user can
 > examine it later. The user is given an opportunity to embed his own
 > message inside the device driver. This message is displayed if a
 > possible infection is detected.  Businesses will find this feature
 > very useful since it can be used to prompt users to report any
 > incidents as instructed by the message. The device driver can also be
 > configured to freeze the computer after displaying the customized
 > message to ensure that it is not ignored.

>> Even if the whole message is a joke, the above is pretty realizable.

  Agreed again. It is realized.

>> In fact, several anti-virus products already offer similar options
>> at least some of them, like automatic restoration of the boot sectors
>> and customized alert messages).

  Yes, to some extent and at a price.

 >    A unique feature of VDS is its decoy launching mechanism.
 > The decoys are used to lure any viruses active in memory and to
 > capture them in a POV (Prisoner Of VDS) file for examination.  The
 > captured intruders can speed up diagnosis process since you will know
 > which virus you are dealing with or whether it is a new virus.

>> The only problem is to convince the virus to infect the decoy... :-)

>> Victor Charlie used a similar approach in the past... maybe still

   If a virus is so difficult to convince, it may also be slowing down
its own infection rate. No, it won't catch them all with decoys.

> only by its readability but also by its technical content. It offers
> practical guidelines and a risk analysis test designed to evaluate the
> vulnerability of your computers to viral attacks.

>> Jokes aside, I think that something like this can be found in Fred
>> Cohen's manual for ASP IT or at least in his "Short Course on
>> Computer Viruses".

    Is it availale for anon FTP? Or should we contact Mr Cohen and beg
for a copy? How much is it?

>    The package includes a special utility program that helps users to
 > recover from all system infectors that target vital areas of
 > drives such as the master boot record. Another program in the package
 > allows users to search DOS-compatible (including network) drives for
 > known viruses.  This program sports an easy-to-use menu-driven user
 > interface as well as a spartan command-line mode for individuals who
 > do not mind remembering half a dozen options. It also has a mechanism
 > to add new virus patterns externally.

>> All this is possible and in fact already available in several
>> products.

  Sure. The end-user is the winner for having another option to choose
from.

Regards,


Tarkan Yetiser
VDS Advanced Research Group               P.O. Box 9393
(410) 247-7117                            Baltimore, MD 21228
e-mail:  tyetiser@ssw02.ab.umd.edu