McAfee’s ViruScan

In online communities, ViruScan has long been regarded as the foremost virus scanner. With frequent updates and a low registration fee, cybersurfers around the world have been using ViruScan to keep their systems healthy for years. With the recent release of an NT version, ViruScan is truly a cross-platform product, with versions for DOS, Windows 3.1, Windows 95, OS/2, and Windows NT.

Installation
ViruScan is usually distributed by an on-line service or over the Internet. To install it, you just unzip the archive file. All files are in a single directory, so you can easily uninstall the application by deleting the directory. However, ViruScan doesn't create a program group, nor does it insert its directory into the path, so you have to add it manually.

ViruScan is a standalone product; it has no option for network support, so you must install a copy on each machine on your network. Because the application is fairly small (a little over 1MB in this release), that requirement shouldn't be a problem.

The first thing you'll notice about ViruScan is that it's a console application; that is, it runs in character mode (see screen 3). This approach has its pros and cons. As a console app, ViruScan can run discreetly as part of a script or batch operation. Without a GUI, however, it's not as flashy as the applications you're used to these days. But what ViruScan lacks in cosmetics, it more than makes up for in speed.

If you're familiar with any other version of ViruScan, you'll be right at home with the NT version. It shares the same commands as the other releases. The most conspicuous addition to this build of ViruScan is NTFS volume support, which makes the native version of ViruScan for NT the only choice for NT users.

Feature Set
ViruScan's power lies in its flexibility. Command parameters let you customize all aspects of its execution--from adding and verifying Checksum validation codes to file exclusion lists. This capability may be slightly confusing, however, because ViruScan has about 40 parameters. If you will use this program often, creating a batch file containing regularly used parameters may be worthwhile.

One potential drawback to ViruScan is that it doesn't automatically log activity to file; you have to specify a command parameter to get activity logging. When used, the log file is a plain text file that you can view with any basic text editor.

I threw the same set of viruses that I used for NAV at ViruScan; all the infected files were detected and cleaned. Unlike the McAfee tools of the past, the Clean module is now integrated with ViruScan, rather than being packaged separately. Thus, the process of cleaning infected files is more convenient, because ViruScan can now clean files on the fly.

ViruScan plowed through all the executable files on a 2GB drive in roughly three minutes. Setting it to scan all files took approximately 27 minutes. The CPU impact is comparable to NAV's. When I checked ViruScan with NT's Performance Monitor, I found a 25% to 30% hit when using IDE disks. This figure will drop some if you're using SCSI disks.

Although this program doesn't include a built-in scheduler interface, you can easily use NT's Scheduler service to launch ViruScan at preset times. While I would like to see an integrated scheduler, this approach worked fine.

Document Support
Microsoft Word users recently discovered the cons of auto-loading macros. It is possible to infect documents with a virus--the most common being the Concept virus--executed as a macro. (You can find more information on Word viruses at http://www.microsoft.com.)

The Concept virus, in a nutshell, only lets you save documents as templates. It replicates through the Word documents on your system. While Microsoft has released a tool that detects and cleans macro viruses, most virus scanners lack the ability to scan Word documents.

ViruScan is the exception. It lets you add Word documents to the file-scan list. In fact, unless you explicitly exclude Word documents from the scan list--with the /nodoc parameter--ViruScan will check all .DOC files by default.

No Archive Support
One feature that is glaringly absent in ViruScan is the ability to scan within compressed archive files. As PKZIP files are becoming the archive format of choice on the Internet, ViruScan's inability to scan within .ZIP files is a notable problem. I hope future versions will include internal .ZIP support. If you frequently download files from an online service, I recommend using NAV to scan stored .ZIP archives.

As new viruses are released, McAfee makes new versions of ViruScan available monthly to catch them. Or, you can download just the Virus Definition Updates from McAfee's FTP server (ftp.mcafee.com) or from CompuServe (GO MCAFEE).

More Pros Than Cons
Overall, ViruScan for Windows NT is an excellent port of McAfee's 16-bit offerings. I was impressed by the number of viruses that ViruScan detected for a first version. However, the lack of a GUI was a turn-off, although I use the program regularly for batch routines. I'd also like to see more NT-specific features, such as network broadcasts and email notification.

Although ViruScan has several drawbacks, the pros outweighs the cons. If you're looking for something quick and reliable that works with batch operations, ViruScan is a good tool for you.

End of Article