• Welcome to OS2World OLD-STATIC-BACKUP Forum.
 

News:

This is an old OS2World backup forum for reference only. IT IS READ ONLY!!!

If you need help with OS/2 - eComStation visit http://www.os2world.com/forum

Main Menu

Norman No Longer Supports OS/2

Started by BigWarpGuy, 2007.09.02, 03:59:21

Previous topic - Next topic

BigWarpGuy

Norman no longer supports OS/2. It is still listed at the eComStation site.
http://www.norman.com/Support/Knowledge_bases/Norman_Virus_Control/OS_2/42559/en
"There will be done no further development on NVC for OS/2. This includes fixing of known bugs and introuduction of new features.

We will continue to support the current version with scanner engine and definition files until June 30th 2008."

"Support  » Technical knowledge base  » Norman Virus Control  » OS/2  » No further development on NVC for OS/2"

Time to look for another anti-vyrus software for OS/2-eCS. Does any one have any suggestions?

Saijin_Naib

Wasnt ClamAV looking promising?

kim

#2
ClamAV is a promising product to use and since there might not be a need an active AV-solution in OS2 there might still for some tasks be a need for an on-demand scanner. ClamAV currently only scans when you tell it to scan; so it's not an active component as one might be used to with other AV software.

Having said that I finds ClamAV an extremely great open source products due to how well it does the job. I use ClamAV on Linux servers to scan all incoming e-mails for virus, for example the OS2 World servers is configured to use ClamAV on all incoming e-mails. On Windows system I use ClamAV as an extra AV scanner on files that I'm a little bit suspicious that I want to give an extra scan on. I've made some small simple test with trojan code where I found that ClamAV does a better job on it's findings than NOD32, Symantec AV and Panda.

Saijin_Naib

Have you/can you compare ClamAV to Trend Micro PC-CILLIN and Windows Defender?
Also, how easily does ClamAv work under OS/2? Is there a PM interface, or only command-line?

RobertM

Quote from: Saijin_Naib on 2007.09.04, 21:49:38
Have you/can you compare ClamAV to Trend Micro PC-CILLIN and Windows Defender?
Also, how easily does ClamAv work under OS/2? Is there a PM interface, or only command-line?

I dont know of a PM interface for ClamAV, but one would be pretty easy to write... perhaps not a neat solution, but doable.

I don't know how it compares to Windows Defender (as I am not sure what SpyWare detection/protection ClamAV has), but Windows Defender is frequently rated as one of the worst for Windows (even by magazines that MS has large financial interests in). ClamAV's ratings seem to vary from OK, to really good...


|
|
Kirk's 5 Year Mission Continues at:
Star Trek New Voyages
|
|


kim

#5
As mentioned already ClamAV doesn't have any GUI (yet) for OS2, so it's plain command line; but then again; you either link up to you mail software to scan incoming e-mails. Create some icons to start the scan or set up a cron job using any of the cron job schedulers available for OS2.

I usually once a while have some prepared files that is infected with virus and trojans to test the system once a while and it was then I noticed that quite often that quite  a few of the AV software available aren't that great on finding trojans and other malicious software. So I usually uses ClamAV as an complement on Windows clients and on OS2 as the only AV software. Then again, after that we set up both Greylisting, Spamassasin and ClamAV on the all mail servers I don't get any viruses via e-mail and maybe a couple of spams every week. Earlier I had 10-20 spam per mail account and I have around 15 different mail accounts....

And about spam, virus and rejected e-mails here is current status:


warpcafe

Hi guys,

well basically it's not too complicated to turn ClamAV into an on-access scanner.
All it would take is an appropriate filesystem "driver" that scans a file upon being accessed.

I remember that Avira (makers of "AntiVir" if someone knows this free Windows AV software) had shares in developing "DaZuKo" (Acronym for German word for "FileAccessControl") which is an open-source project providing such a filter.

If someone is interested - here's a link:
http://www.dazuko.org/

As you can see - all bits and pieces are available, with documentation and source code (for Linux at least...)
If we could find a developer willing to create such a filesystem driver for OS/2 (e.g. for HPFS partitions) we would have world-class, up-to-date, on-access scnning by using ClamAV's scanning engine.
Volunteers everyone? ready for a bounty? :-)

Regards,
Thomas
"It is not worth an intelligent man's time to be in the majority.
By definition, there are already enough people to do that"
- G.H. Hardy

kim

I will directly support a bounty for above mentioned to get file system driver to implement ClamAV better.

BigWarpGuy

I think it is a great idea for a bounty.  8)

RobertM

In addition, it might be able to be (easily) linked to the network subsystem. It does support scanning streams coming in/going to a port and then providing the mechanism to route the scanned data to the port.


|
|
Kirk's 5 Year Mission Continues at:
Star Trek New Voyages
|
|


warpcafe

Guys,

Cool, I didn't think that my comment would start such a great discussion (great in matters of vision).
And, hey, wow... never thought of letting it scan streams (like network traffic). Pretty cool idea.

What I'ld be interested in is to find out on the performance impact of using ClamAV for such things like network traffic scan or on-demand file access scanning... of course keeping in mind that this all assumes that it's feasible.
Heck, I'm even willing to pay 50 Euro into a bounty that is used only for a feasibility study "CAN we make filesystem filters using ClamAV". Is there any developer around who has a concept about filesystem driver programming? Or should we go for a Netdrive plugin for ClamAV if that is feasible?

Regards,
Thomas
"It is not worth an intelligent man's time to be in the majority.
By definition, there are already enough people to do that"
- G.H. Hardy

warpcafe

Hi, more information - this is from the "About" page of DaZuKo:

QuoteThis project provides a device driver allowing 3rd-party (userland) applications to execute file access control. It was originally developed by Avira GmbH (formerly known as H+BEDV Datentechnik GmbH) to allow on-access virus scanning. Other uses include a file-access monitor/logger or external security implementations. It operates by intercepting file access calls and passing the file information to a 3rd-party application. The 3rd-party application then has the opportunity to tell the device driver to allow or deny the file access. The 3rd-party application also receives information about the access event, such as accessed file, type of access, process id, and user id.
Hmm... does that mean we could even use it to recreate user-based ACLs from scratch? ;-)

[snip...]

QuoteThe current status of the project is usable for Linux 2.2-2.6, Linux/RSBAC, and FreeBSD 4.x-6.x. However we would like to see the project expand to support other operating systems such as MacOS X, Solaris, OpenBSD, and Windows, as well as expand in functional capabilities.
Yeah, please add OS/2+eCS to the list! :-)

While navigating through the DaZuKo pages, I found a lit of applications that make already use (on Linux?) of the DaZuKo interface. Woo-hoo, there's some well-known products mentioned:

  • avast! antivirus
  • AVG Linux Edition
  • Clam AntiVirus
  • F-Secure Client/Server Security
  • NOD32 for Linux File Server

...do I need to say more? :-)
I think a (somehow) ported DaZuKo will give us lots of possibilities! Thinking about the fact that it was already proted to different flavors of *nix, chances might be that we could rather make a ported DaZuKo being able to work with JFS? Know what I want to say...?
I don't have clue about filesystem drivers. I know that we have FAT, FAT32, HPFS(-386) and JFS and I have no idea how a "DaZuKo-driver" must be incorporated into that IFS stuff... I think we need an expert. Any suggestions on whom to talk? Volunteers? Yellow pages? ;-) Or should we just hand over a bucket full of money on the 2008 developer workshop and see what it becomes? :-))

And regarding filesystems (for those interested) here's something else quite interesting:
http://www.filesystems.org/

Regards,
Thomas
"It is not worth an intelligent man's time to be in the majority.
By definition, there are already enough people to do that"
- G.H. Hardy

chennecke

With regard to ClamAV, you may want to note that IIRC a recent test in the German c't magazine didn't turn out too well for it. Looks like its search engine isn't too hot.

chennecke

Regarding the On-Access feature: The next XWorkplace will include an interface for the OS/2's  file-changed notification feature. Normally, only one client can use it, and that's the WPS. But with XWorkplace, several clients will be able to do so. This should be very interesting for anybody who thinks about system integration of a virus scanner.

kim

Quote from: Christian Hennecke on 2007.09.08, 15:12:33
With regard to ClamAV, you may want to note that IIRC a recent test in the German c't magazine didn't turn out too well for it. Looks like its search engine isn't too hot.

Do you have a link to the mentioned article or test; if available?