========================== Product Evaluation Report ========================== Product Name: Thunderbyte Manufacturer: ESSaSS, Nijmegen, The Netherlands Version: 1.00 Features: Hardware card with driver software. Product Description: Anti-virus Product, Hardware. Test Environment: IBM PC/XT and IBM PC/AT with DOS 3.30 Tests performed by: Jan R. Terpstra (on personal initiative) Report written by: Jan R. Terpstra (1990/10/03) =============================================================================== 1. PRODUCT INSTALLATION ----------------------- As the product is a hardware card with driver software, the installation consists of two steps: - Installation of the card in the machine and connecting the card edge connector via a cable to the harddisk controller and the harddisk. This connection is used by the Thunderbyte card to check write operations on the harddisk. The manual describes the installation steps in a clear way and installation is easy to perform. Non-technical people can follow the installation steps without problems, but they may not understand all of the manual. Before the card is installed, a program TBINSTAL needs to be run. This program inspects the PC, checks for other adapters and outputs a recommended switchsetting for the card. I need to mention an oversight of the manufacturer where it comes to the ruggedness of the product. The Thunderbyte card is simply plugged in an available slot in the PC, but it does not have a bracket to secure the card to the back of the PC chassis. The card merely sits in the bus connector without any additional mechanical support. This will not pose a problem in desktop equipment, but carrying around a portable computer equiped with a Thunderbyte card is not recommended, the card may pop out of the bus connector, likely to cause sa short circuit. Switching the power on when the card is laying around in the computer may give some bad surprises. Hopefully this will be fixed in a newer release of the product. Configuration of the card is well described in the manual. All applicable switch settings are listed with a short but easy to understand comment. To make things een more easy, the configuration program shows the recommended switch settings when run. - Installation of the software merely consist of copying the file TBCONFIG.COM to the harddisk of the PC. TBCONFIG is normally not needed, but can be used to change the operation of the Thunderbyte card without the need of opening the computer. TBCONFIG can be loaded as a device driver, started from your AUTOEXEC.BAT or manually. English, German and Dutch versions of the programs are on the installation diskette and the Thunderbyte card changes the language of it's messages accordingly (nice touch!). - Some other features are: * A startup password, which the user will be prompted for when the computer is powered on. * Booting from a diskette can be disabled completely to prevent people from using the machine if they do not know the password. * Booting from the B: diskette drive All in all, the installation of the product is without problems, except for the remark about the lack of a card mounting bracket. There is an additional program is on the installation diskette: TBSCAN.COM, a virus scanner which should be run from a known good DOS diskette to check for viruses on your PC. The program is simple and fast, but may give a false sense of security. TBSCAN, as with most virus scanners, can ONLY recognize the viruses it knows about, i.e. those viruses that are listed in the TBSCAN.DAT datafile. 2. OPERATION ------------ Once installed, the user will probably never notice the product, unless something really odd happens. Starting with a "clean" machine, I ran most of the computer viruses from my collection against Thunderbyte. The card intercepted all of them. Whenever Thunderbyte is suspicious about a write operation to disk, it will pop a window with a warning text. Depending on the configuration of the card, you can select to let the operation continue or immediately abort it. Also, write activity in the disk interface can be detected. This detection scheme is the reason for the funny cable that is installed between harddisk and controller. Whenever the WRITE line on the disk interface becomes active, Thunderbyte will check if this write was triggered by a legitimate DOS call. If not, the write will be intercepted. This feature catches viruses and Trojan horse programs that try to mess up the harddisk by directly manipulating control registers on the controller. Writing to .COM files or to .EXE file headers will trigger Thunderbyte. Programs like MicroSoft's EXEMOD and Incremental Linker change the header info of .EXE files. Presuming those programs are used by people that understand what they are doing, this "false" alert will not really lead to unfounded panic and formatting of disks that are suspected of being infested with unknown viruses. I found one odd problem with Thunderbyte. The card sometimes intercepts a legitimate FAT update by DOS as a BOOT sector modification. After a talk with the manufacturer of Thunderbyte, I found out the reason for this odd behaviour: This occurs only on disks that have been formatted in such fashion that the FAT starts directly after the Partition Table of the disk. Harddisks that have been low-level formatted by the ROM routines of certain harddisk controllers (Using DEBUG, G=C800:5,) or disks that were formatted by special purpose device drivers may show this symptom. ESSaSS will fix it in a future release of the Thunderbyte ROM code. All in all, I'm impressed by Thunderbyte. It has been installed in my separate virus investigation computer for a number of weeks now and it has caught all viruses I purposely ran on the machine and even some NEW viruses that were hidden in files I received for inspection. In short, Thunderbyte works. However, 100% safety can never be guaranteed. It is very hard to do and the change is extremely small, but it *IS* possible that one day a smart virus writer will come up with an idea that will fool Thunderbyte. For the moment, however, it is one of the most sophisticated anti-virus tools I have seen. Software-only solutions will never reach the level of protection that this card achieves. 3. COMMENTS ----------- Positive: - Easy to install. - Simple to operate. - Uses very little RAM space. - Multilingual product. - Virtually invisible for the every day user. - A HARDWARE solution, not easy to break by malicious software. - No strange incompatabilities, except for the EXEMOD and Incremental Linker warnings, but those are probably unsolvable. Negative: - No mounting bracket - For non-technical persons, some ppart of the manual may be too technical. Some more non-techie explanation may prevent unwanted panic about computer viruses. (i.e. "Educate the User!"). - Only available for PC and PC/AT, no MCA version available (yet?). - Works only with PC-DOS and MS-DOS. Versions for Xenix, AIX and OS/2 would be nice, but these are environments were viruses are not (yet?) often seen. - The erroneous detection of BOOT sector modifications needs to be fixed! <<