Technology Today - March 2004
by Robert Sanborn 

Hauri ViRobot Anti Virus Program 

As the latest round of viruses and worms make their way to my computer, I often thank those of you out there that have let their anti virus programs laps or not update the definition files. I really wish I could point my finger at who ever does this and give them a swift kick in the pants and elsewhere depending on how many have flooded my in box.  So whenever a new anti virus program comes out, I like to take a look at it because after the latest flood, I really want to be sure my system is clean and protected.  Latest to make my desk was from Hauri, a Korean company, who has recently set up shop on these shores, www.globalhauri.com and what they claimed that caught my eye is that their anti virus program, ViRobot, not only catches more viruses out there than the others, but does it much quicker, and even more importantly, will fix the file on the fly rather than quarantine or delete the file infected. This is probably the most important distinction I have seen yet in an anti virus company. A complete real time eradication of a virus. You don’t have to download a separate fix program to get rid of it or jump through hoops in the registry and elsewhere on your computer. 

This company has been around for several years with this product but it looks like just haven’t made that much of an impression in the US Market. When we bumped into them at Comdex, they were showing off how their product caught some typical viruses that McAfee and Symantec did not so I was really interested in taking a closer look. Take the Nimda or Fun Love problems we have all been plagued with. With any of the other programs, you have to get a fix module to get rid of them while with the ViRobot, it does it on the fly.  I was a bit skeptical but took a look at the web site www.virusbtn.com, a London based independent virus bulletin. What they do is to test all the leading companies to see how their programs stack up to each other. Now when you look at the web site, and I will continue to pick on Symantec because they are the leader in this field, what you see can be a bit misleading. I went to look at Symantec’s grade and the first thing it tells you is that it passed 22 times and failed 6. What these results really mean is that of the 28 times they tested Symantec’s products over the past several years, 22 times it captured every virus that was thrown at it and six times it did not. So far, their success rate dating back to November 1999 has been 100%. Right now that is pretty impressive to catch every single one the past three years. Look up Network Associates (former McAfee), Grisoft, Kaspersky, and others and you will see a far worse performance. Even Hauri did not do as well over the long term but what we are really interested in knowing is how they are doing today and this report is an informative way of looking at the anti virus companies. 

So with all that in mind, the first thing I did was to run the Norton Antivirus 2003 on my notebook and see how long it took to give me some comparison figures to use. With 47,000 plus files to scan, Norton did it in 48 minutes. This is on my IBM ThinkPad which is an older Celeron 333 with 64mb of Ram running Windows98 I picked this computer to use simply because my Norton’s subscription had just recently expired on it so this was a perfect opportunity to install Hauri’s program.  Their current product is ViRobot Expert version 4.0. When you start the program, it first tells you to uninstall any of your current anti virus programs and then just closes. So off to Add Remove Programs in control panel and with that, I uninstalled my Norton Anti Virus. For ease of use, I would have preferred that ViRobot do it for me. After uninstalling NAV, I tried to run the setup program again but got an error telling me it was not a valid Win32 bit application. At this point, I needed to uninstalled the rest of Symantec’s products (Live Reg and Live Update), clean up the registry and tried again. One of the more truly irritating things about Symantec programs is that sometimes, they are really hard to get rid of.  

Installing the program is pretty simple. Just start up the Setup program and you can easily take all the defaults. You should be connected to the internet when you do that so it can go out and get its updates. In my case, it said it was going to download 7.5 mb of files comprising 40 downloads so I would have thought that with a new CD from them, it would have gone much more quickly. What was also interesting was the Read Me file was dated from February 2002, two years old. An interesting note I found while reading it; according to the license agreement, if you install it on your pager, you cannot install it on your hand held PC, smart phone, or personal computer. Of course, right now they don’t offer versions for any of those. According to the Read Me file, it will still run on an Intel 486 system with 16mb of memory which gives you a lot of flexibility for older computers and older operating systems as well.  

Once it is installed, you just need to make sure that it is turned on resident mode to keep actively scanning all incoming files to your computer; this is something I would have thought it would have done automatically. To see how fast it runs, I turned on the scan and checked the time. This scan took 43 minutes, only five minutes faster than the Norton and interestingly enough, scanned fewer files. Does it count the files inside compressed files as well or not. Things like that are difficult to figure out sometimes. What this quick comparison doesn’t tell you is that the program uses far fewer resources of your computer than does Norton. What that means is that you can continue to work on your computer and in fact, I spent most of the time checking email, surfing the web, and working with some zip files all the while it was scanning and still ran faster. In talking to some folks at Hauri, they tell me that they have benchmarked ViRobot to take less than 10 percent of the system resources while scanning while some of the other programs take up to 70%. This was how I was able to actually do some other things on the slow Celeron 333 system I have.  I also see that it seems to work with my other applications just fine. Zone Alarm Pro wanted verification before it could go get its updates and that was also just fine. You will also need to tell Zone Alarm to allow the update module to access the internet as well.  

The shortcomings that I see so far with this program are in its setup and installation and use and are to be honest, more cosmetic than anything else. While I prefer not to register a program to keep from getting more junk mail, software should make it as painless and easy as possible to get people to do so and Hauri just tells you to go to a web site to register. Like most other packages, you get a one year subscription with installation of the software and according to the manual, it will cost you half the retail price ($20) to renew your subscription.  

Getting updates seem a little confusing as well. When you start ViRobot Expert, it will automatically go to the web if you are connected to see if there are any updates if you set the option in the configuration file. You can also launch the update wizard (which really all it does is go get the update), from the tools menu or from the icon in the menu bar. What it doesn’t seem to do is to schedule more frequent updates so if you are off line or don’t shut down the program for any length of time, it might not be up to date. Under the tools menu, you can start up the schedule wizard who will allow you to pick a date or time to either do a full system scan or an update and so what I did was to set it up to update itself each day after midnight. If you use dial up, you probably need to do the update yourself and at a minimum, I would recommend at least weekly.   

But you know, the real proof in an anti virus program is what happens when it finds something and right now, I think that ViRobot’s technology is second to none. When ViRobot starts, it will first scan itself to make sure there are no problems and then to check memory and the boot sector. This to me is an important feature as quite often, the first thing a virus targets is the anti virus program and I would want something alerting me if it is not working properly. Too many times I see a disabled McAfee or Norton icon but if you don’t focus on it, you can loose it among all the icons that sit in the system tray and not notice that it is not protecting your computer. Even worse are the viruses that will disable part of the program and you have no hint at all that something is wrong. One of the things I like about Norton is that you see an envelope appear in the task bar each time it checks the contents of incoming email. I like that because it gives you a second indication that it is checking the emails you download and is working. Hauri gave me no such notice. I went to check to be sure it was doing the emails and it shows that Outlook Express is the preferred email client but then shows an empty check box below where I suspect it would tell me which email accounts it was checking. However, when I emailed the test account a virus, Hauri picked it up before it even had a chance to be looked at. And I want to emphasize that to me the biggest advantage that Hauri has is that it will remove the viruses found on the fly. If you look at Symantec’s web site, www.sarc.com, you will find over sixty listed there for everything from Nimda to Sobig to My Doom. ViRobot needs no such tool or removal process to get rid of them both in memory and in running programs. Once found on your system, it is gone. This is a real advantage to server systems where you don’t want to have to shut down the server to remove the viruses that have infected it and then wait for it to be rescanned to make sure they are gone. 

Hauri ViRobot Expert is available for $40 downloaded from their web site. If you do buy it, the web site tells you that you will have to wait two to three days for the serial number to arrive by email. I suspect you will be able to check your system because they start with a 30 day free trial so when the serial number comes, you can enter it. The website does contain a lot of information about the products they sell but when I checked the support section, I noticed that there were only seven FAQs listed. In looking at the online PDF manual I got, while extensive, the pictures and images are difficult to read. ViRobot looks like it was written by programmers for programmers and that leaves people not used to such quirks wondering where things are. I really like how Symantec’s Norton Anti Virus displays how things stand, I hope that the folks at Hauri will soon update the user interface to give us a better idea as to where we stand with the subscription and date of the virus definitions.  In short, the technology advantages to ViRobot and the real time virus removal are the major pluses along with the fact that it is not such a resource hog for older computers. For the time being though, for those people who can’t seem to keep the anti virus programs updated and want something easy to check, I would still recommend the Norton Anti Virus because I think it does a better job keeping your system up to date. For advanced users, take a good look at ViRobot. 

Short Takes 

HP iPAQ 

Well, it was time to upgrade. I have had my Casio Pocket PC computer for a couple of years now and keep running into things I want to do with it but naturally, needed more memory, more disk space, newer operating system, and the like. Sounds a lot like the same pains in upgrading a computer when you really like the way the old one works but just have to give in because of all the new things you want to do with it. What was the straw that broke my camel’s back was that I had gotten a new GPS system and wanted to keep more of the maps and the like on the Casio but with limited memory, and only one accessory slot, had troubles keeping up. So I got a new HP iPAQ 2215 model. I chose the HP because it looked to be the best unit for what I wanted despite my low opinion of their practice of making the software both intrusive and difficult to use. I am hoping that by using the standard windows programs and what I currently have, it will go a bit easier. And so far it has just fine. My only complaint, and one that I have discovered helping other people with this process, is that when you get a new device, Active Sync quite often really prefers only one of these kinds of computers on your desktop.  In my case it managed to remember the Casio and maybe that was due to the newer version of Active Sync that I installed with the iPAQ.

--------------------------------------

Robert Sanborn is a technology analyst for PC Lifeline. You can reach him through the net at robert@pcll.com