OS2World OLD-STATIC-BACKUP Forum

Public Discussions => General Discussion => Topic started by: BigWarpGuy on 2007.09.02, 03:59:21

Title: Norman No Longer Supports OS/2
Post by: BigWarpGuy on 2007.09.02, 03:59:21
Norman no longer supports OS/2. It is still listed at the eComStation site.
http://www.norman.com/Support/Knowledge_bases/Norman_Virus_Control/OS_2/42559/en (http://www.norman.com/Support/Knowledge_bases/Norman_Virus_Control/OS_2/42559/en)
"There will be done no further development on NVC for OS/2. This includes fixing of known bugs and introuduction of new features.

We will continue to support the current version with scanner engine and definition files until June 30th 2008."

"Support  » Technical knowledge base  » Norman Virus Control  » OS/2  » No further development on NVC for OS/2"

Time to look for another anti-vyrus software for OS/2-eCS. Does any one have any suggestions?
Title: Re: Norman No Longer Supports OS/2
Post by: Saijin_Naib on 2007.09.02, 09:06:21
Wasnt ClamAV looking promising?
Title: Re: Norman No Longer Supports OS/2
Post by: kim on 2007.09.02, 11:52:56
ClamAV is a promising product to use and since there might not be a need an active AV-solution in OS2 there might still for some tasks be a need for an on-demand scanner. ClamAV currently only scans when you tell it to scan; so it's not an active component as one might be used to with other AV software.

Having said that I finds ClamAV an extremely great open source products due to how well it does the job. I use ClamAV on Linux servers to scan all incoming e-mails for virus, for example the OS2 World servers is configured to use ClamAV on all incoming e-mails. On Windows system I use ClamAV as an extra AV scanner on files that I'm a little bit suspicious that I want to give an extra scan on. I've made some small simple test with trojan code where I found that ClamAV does a better job on it's findings than NOD32, Symantec AV and Panda.
Title: Re: Norman No Longer Supports OS/2
Post by: Saijin_Naib on 2007.09.04, 21:49:38
Have you/can you compare ClamAV to Trend Micro PC-CILLIN and Windows Defender?
Also, how easily does ClamAv work under OS/2? Is there a PM interface, or only command-line?
Title: Re: Norman No Longer Supports OS/2
Post by: RobertM on 2007.09.05, 00:29:34
Quote from: Saijin_Naib on 2007.09.04, 21:49:38
Have you/can you compare ClamAV to Trend Micro PC-CILLIN and Windows Defender?
Also, how easily does ClamAv work under OS/2? Is there a PM interface, or only command-line?

I dont know of a PM interface for ClamAV, but one would be pretty easy to write... perhaps not a neat solution, but doable.

I don't know how it compares to Windows Defender (as I am not sure what SpyWare detection/protection ClamAV has), but Windows Defender is frequently rated as one of the worst for Windows (even by magazines that MS has large financial interests in). ClamAV's ratings seem to vary from OK, to really good...
Title: Re: Norman No Longer Supports OS/2
Post by: kim on 2007.09.05, 02:00:00
As mentioned already ClamAV doesn't have any GUI (yet) for OS2, so it's plain command line; but then again; you either link up to you mail software to scan incoming e-mails. Create some icons to start the scan or set up a cron job using any of the cron job schedulers available for OS2.

I usually once a while have some prepared files that is infected with virus and trojans to test the system once a while and it was then I noticed that quite often that quite  a few of the AV software available aren't that great on finding trojans and other malicious software. So I usually uses ClamAV as an complement on Windows clients and on OS2 as the only AV software. Then again, after that we set up both Greylisting, Spamassasin and ClamAV on the all mail servers I don't get any viruses via e-mail and maybe a couple of spams every week. Earlier I had 10-20 spam per mail account and I have around 15 different mail accounts....

And about spam, virus and rejected e-mails here is current status:

(http://www.os2world.com/mailstatus)
Title: Re: Norman No Longer Supports OS/2
Post by: warpcafe on 2007.09.05, 17:39:49
Hi guys,

well basically it's not too complicated to turn ClamAV into an on-access scanner.
All it would take is an appropriate filesystem "driver" that scans a file upon being accessed.

I remember that Avira (makers of "AntiVir" if someone knows this free Windows AV software) had shares in developing "DaZuKo" (Acronym for German word for "FileAccessControl") which is an open-source project providing such a filter.

If someone is interested - here's a link:
http://www.dazuko.org/

As you can see - all bits and pieces are available, with documentation and source code (for Linux at least...)
If we could find a developer willing to create such a filesystem driver for OS/2 (e.g. for HPFS partitions) we would have world-class, up-to-date, on-access scnning by using ClamAV's scanning engine.
Volunteers everyone? ready for a bounty? :-)

Regards,
Thomas
Title: Re: Norman No Longer Supports OS/2
Post by: kim on 2007.09.05, 18:10:24
I will directly support a bounty for above mentioned to get file system driver to implement ClamAV better.
Title: Re: Norman No Longer Supports OS/2
Post by: BigWarpGuy on 2007.09.06, 03:02:09
I think it is a great idea for a bounty.  8)
Title: Re: Norman No Longer Supports OS/2
Post by: RobertM on 2007.09.06, 04:36:05
In addition, it might be able to be (easily) linked to the network subsystem. It does support scanning streams coming in/going to a port and then providing the mechanism to route the scanned data to the port.
Title: Re: Norman No Longer Supports OS/2
Post by: warpcafe on 2007.09.06, 12:39:03
Guys,

Cool, I didn't think that my comment would start such a great discussion (great in matters of vision).
And, hey, wow... never thought of letting it scan streams (like network traffic). Pretty cool idea.

What I'ld be interested in is to find out on the performance impact of using ClamAV for such things like network traffic scan or on-demand file access scanning... of course keeping in mind that this all assumes that it's feasible.
Heck, I'm even willing to pay 50 Euro into a bounty that is used only for a feasibility study "CAN we make filesystem filters using ClamAV". Is there any developer around who has a concept about filesystem driver programming? Or should we go for a Netdrive plugin for ClamAV if that is feasible?

Regards,
Thomas
Title: Re: Norman No Longer Supports OS/2
Post by: warpcafe on 2007.09.06, 13:05:51
Hi, more information - this is from the "About" page of DaZuKo:

QuoteThis project provides a device driver allowing 3rd-party (userland) applications to execute file access control. It was originally developed by Avira GmbH (formerly known as H+BEDV Datentechnik GmbH) to allow on-access virus scanning. Other uses include a file-access monitor/logger or external security implementations. It operates by intercepting file access calls and passing the file information to a 3rd-party application. The 3rd-party application then has the opportunity to tell the device driver to allow or deny the file access. The 3rd-party application also receives information about the access event, such as accessed file, type of access, process id, and user id.
Hmm... does that mean we could even use it to recreate user-based ACLs from scratch? ;-)

[snip...]

QuoteThe current status of the project is usable for Linux 2.2-2.6, Linux/RSBAC, and FreeBSD 4.x-6.x. However we would like to see the project expand to support other operating systems such as MacOS X, Solaris, OpenBSD, and Windows, as well as expand in functional capabilities.
Yeah, please add OS/2+eCS to the list! :-)

While navigating through the DaZuKo pages, I found a lit of applications that make already use (on Linux?) of the DaZuKo interface. Woo-hoo, there's some well-known products mentioned:

...do I need to say more? :-)
I think a (somehow) ported DaZuKo will give us lots of possibilities! Thinking about the fact that it was already proted to different flavors of *nix, chances might be that we could rather make a ported DaZuKo being able to work with JFS? Know what I want to say...?
I don't have clue about filesystem drivers. I know that we have FAT, FAT32, HPFS(-386) and JFS and I have no idea how a "DaZuKo-driver" must be incorporated into that IFS stuff... I think we need an expert. Any suggestions on whom to talk? Volunteers? Yellow pages? ;-) Or should we just hand over a bucket full of money on the 2008 developer workshop and see what it becomes? :-))

And regarding filesystems (for those interested) here's something else quite interesting:
http://www.filesystems.org/

Regards,
Thomas
Title: Re: Norman No Longer Supports OS/2
Post by: chennecke on 2007.09.08, 15:12:33
With regard to ClamAV, you may want to note that IIRC a recent test in the German c't magazine didn't turn out too well for it. Looks like its search engine isn't too hot.
Title: Re: Norman No Longer Supports OS/2
Post by: chennecke on 2007.09.08, 15:25:11
Regarding the On-Access feature: The next XWorkplace will include an interface for the OS/2's  file-changed notification feature. Normally, only one client can use it, and that's the WPS. But with XWorkplace, several clients will be able to do so. This should be very interesting for anybody who thinks about system integration of a virus scanner.
Title: Re: Norman No Longer Supports OS/2
Post by: kim on 2007.09.08, 15:38:19
Quote from: Christian Hennecke on 2007.09.08, 15:12:33
With regard to ClamAV, you may want to note that IIRC a recent test in the German c't magazine didn't turn out too well for it. Looks like its search engine isn't too hot.

Do you have a link to the mentioned article or test; if available?
Title: Re: Norman No Longer Supports OS/2
Post by: chennecke on 2007.09.09, 19:21:12
Quote from: kimhav on 2007.09.08, 15:38:19
Quote from: Christian Hennecke on 2007.09.08, 15:12:33
With regard to ClamAV, you may want to note that IIRC a recent test in the German c't magazine didn't turn out too well for it. Looks like its search engine isn't too hot.

Do you have a link to the mentioned article or test; if available?

Sorry, no online version. But here are the results for ClamAV's detection qualities (percentages of the best contestant in brackets):

ITW list: 93,5 % (100 %)
Backdoors, bots, trojans: 48,5 % (99,9%)
Ad- and spyware: 6,5% (99,3%)
Heuristics of 1 and 2 months old: 11,5 %, 8,5 % (61 %, 54 %)
Signatures, virus modifications: 58,5 % (95,1 %)

Certainly better than nothing but also a potential risk for false security. The real problem is that there won't be any alternative once Norman withdraws support. At least I don't know of any. Panda, Sophos, etc. have all withdrawn their OS/2 versions.
Title: Re: Norman No Longer Supports OS/2
Post by: onlineuser2 on 2007.09.10, 17:54:45
The real problem is that there won't be any alternative once Norman withdraws support. At least I don't know of any. Panda, Sophos, etc. have all withdrawn their OS/2 versions.

It seems that dr web av os/2 version is still working update to its standard (unfortunatley only by command line), as you can see in the download page: http://download.drweb.com/.

That's does not change the need for claim av os/2 pm gui.

Or does it add the need for a os/2 gui for dr web av, too?

by
onlineuser2
Title: Re: Norman No Longer Supports OS/2
Post by: Terry on 2007.09.10, 22:04:15
Would a linux anti-virus application work for eCS-OS-2, if eCS-OS/2 is a virtualization guest operating system, under a linux virtualization host operating system? ...or a host WinXP system?

If so, it would not be an "eCS-OS/2 perfect" option, but an option none the less.  Otherwise, it appears that Clam AV is probably our best bet for a "ported-native" anti-virus.
Title: Re: Norman No Longer Supports OS/2
Post by: Saijin_Naib on 2007.09.16, 08:21:12
Why do all these companies withdraw OS/2 support?
Title: Re: Norman No Longer Supports OS/2
Post by: BigWarpGuy on 2007.09.17, 01:37:55
Quote from: Saijin_Naib on 2007.09.16, 08:21:12
Why do all these companies withdraw OS/2 support?

They probably go by the number of users of an operating system when compared to the cost of development for that operating system. It would be nice if the number of eCS users increased so that companies would reconsider support it.