VB Comparative: Netware 6.5 - August 2005

eTrust is a useful example of the two facets of administration where NetWare products are concerned. The two main methods are to administer from a GUI (either on a client or server) or simply to interact in the server console. The latter tends to look very archaic compared with the usual interfaces for such software. In the case of eTrust, the on-demand scanning can be controlled fully through the server console. This may also be controlled through an administration tool on a client. If full control of on-access scanning is required, however, this must be performed from the client.

Having been somewhat confused by this division of control options, the actual scanning processes were easy by contrast. Even better, NetWare logging is free from those strange formats which plague the Windows versions of eTrust. When logs were parsed there were no real surprises and a VB 100% award was the result.

Please refer to the PDF for test data

Installation of Quick Heal is by a client-side installation routine, though the same effect may be obtained manually with little trouble. Along with this simplicity of installation, the interface is simple both in appearance (it operates through the server console) and in the limited number of options available. All the usual options are present, it is simply that they are more conveniently grouped than in many products and are not obscured by components of dubious value. Admittedly, this feeling of a lack of clutter is much helped by the fact that the on-demand and on-access components are separate NLMs. Offsetting the clarity somewhat was the log file, which changed the cases of filenames and reduced long file names to 8+3 format, somewhat hindering extraction of test results.

In fact, of all the products in this test, the results for Quick Heal showed the most variation between on access and on demand. Despite this, however, Quick Heal detected all the samples in the ItW test set, and generated no false positives, and a VB 100% award is thus due.

Please refer to the PDF for test data

Doctor Web's NetWare product remains essentially the same in look and feel as when I inspected it several years ago. Setting it up is performed simply by copying the files to the server and loading the NLM. This either results in a working interface or exits with the reason for failure dumped to a log. The lack of an on-screen message to inform me that the licence key was not found, caused me a little perplexity until I found this log. However, once installed all went smoothly.

Scanning results were much the same as have been noted in recent Windows testing. Dr.Web seems to alternate between full detection and missing a small number of samples - the latter presumably being due to the tweaking of older definitions for efficiency. No misses occurred in the ItW set, however, and with no false positives Dr.Web receives a VB 100%

Please refer to the PDF for test data

Likewise unchanged since the last few tests, the on-demand and on-access scanners of NOD32 are each comprised of an NLM which is loaded from the server console. The word 'loaded' is perhaps a little misleading in the case of the on-demand scanner which, alone in these tests, operates as a command-line scanner rather than having any more advanced interface.

This rather aged interface might cause second thoughts for some users. The full detection rates and good scanning speed, however, can cause no such issues and result in a further VB 100% award for Eset.

Please refer to the PDF for test data

The Kaspersky product is rather more evolutionarily advanced than some others, the default installation from the client being one sign of this. It installs as a snap-in to ConsoleOne, Novell's NetWare GUI. After installation there are two server console interfaces, one each for the on-demand and on-access scans. These are, however, informational rather than interactive, and scanning during testing was controlled via the ConsoleOne interface. Logging proved somewhat confusing for a while, until it became clear that the use of ampersands in file names was causing the log entries to become garbled.

With the log files unravelled there was a small difference in results between the on-access and on-demand tests, with the latter showing full detection. However, the files missed on access were due to the understandable removal of archive handling for files in this mode - a common efficiency measure. None of the files missed were in the ItW test set and thus Kaspersky receives another VB 100% in this month's bumper crop.

Please refer to the PDF for test data

The installation of NetShield was delayed a little by the requirement for a Java runtime to be available on the machine from which the install will take place. Once this hurdle had been overcome, the process of installation from a client was simple enough. Updates and upgrades were applied to the software by the expedient of unloading the NLMs and overwriting old files with new - which seems to be a common method in NetWare.

The main NLM for NetShield operates as a server console-viewable interface, though it can only be inspected in this state. In order to adjust the configuration, the client side application must be used. This offers exactly the same interface as NetShield on other platforms. The developers seem to have opted for minimising network traffic during scanning, since despite having a scan status visible in the GUI, this status was not updated between the start and end point of any scan.

With no samples missed in any of the test sets, and no false positives generated in the clean set, McAfee is due a VB 100% award without further ado.

Please refer to the PDF for test data

The installation procedure for FireBreak is performed from the client, requiring a drive to be mapped to the root of SYS: on the server. A ConsoleOne snap-in and Internet update module are installed as part of this process, though the server console interface was used for testing.

On the occasion of the last review, there were a number of problems for Norman's product, associated with scanning. Thankfully these were notable only by their absence this time.

The detection rate was very much at the level usually achieved by Norman. Weaknesses still exist in the handling of relatively modern polymorphic viruses, though none of these were present in the ItW test set. A VB 100% award is the net result.

Please refer to the PDF for test data

Another product adhering firmly to the server console style of interface, Sophos Anti-Virus is also very much unchanged by the passage of time. Installation is by the loading of a single NLM, which creates the appropriate directories and populates them. This is a convenient set up procedure, which avoids the irritation of setting search paths and directory structures. Having added supplementary virus identities the product is ready for operation.

Age-old niggles still exist during operation, however. The requirement to prepend '>' to paths in order to force recursive scanning is among the more idiosyncratic parts of the interface. The log file is now out of step even with other Sophos products, still reducing long file names to the less than useful '?????~?.???' format. It should be noted that it is impossible to scan anything other than a full volume using the extension lists supplied, thus the scanning here was performed on all files in a supplied path. Despite these peculiarities the scanning performed without any hitches and resulted in a full detection of ItW files. A VB 100% is thus secured by Sophos.

Please refer to the PDF for test data

VirusBuster installs by copying its files to the server, setting the location as a search path and loading the main NLM. The main issue with VirusBuster concerned its speed of scanning infected files. This was noticeably slow in the ItW test set, though this is common enough with the unpacking required for some of the bot samples in the collection.

Rather more frustrating were some polymorphic samples. In particular, Satanbug.5000.A took over a minute per sample to be scanned in many cases. With 500 samples of this virus alone in the test sets, scanning was a time-consuming and tedious process indeed. On the plus side, the VirusBuster logs now make a distinction between worms and viruses, though with the eternal debate over the fine distinctions of the nomenclature, this may only serve to inflame passions.

VirusBuster demonstrated the only false positive in the tests, although this was simply a sample which was declared suspicious rather than a full-blown declaration of viral content. Unfortunately, however, VirusBuster missed the W32/Lovelorn.A sample in .HTM form both on access and on demand. As this sample is in the wild, VirusBuster misses out on a VB 100% on this occasion.

Please refer to the PDF for test data