
========================== Product Evaluation Report ==========================

Product Name:  Thunderbyte

Manufacturer:  ESSaSS, Nijmegen, The Netherlands

Version: 1.00

Features: Hardware card with driver software.

Product Description: Anti-virus Product, Hardware.

Test Environment: IBM PC/XT and IBM PC/AT with DOS 3.30

Tests performed by: Jan R. Terpstra (on personal initiative)

Report written by: Jan R. Terpstra (1990/10/03)

===============================================================================


1. PRODUCT INSTALLATION
-----------------------

As the product is a hardware card with driver software, the installation
consists of two steps:

- Installation of the card in the machine and connecting the card edge
  connector via a cable to the harddisk controller and the harddisk.
  This connection is used by the Thunderbyte card to check write operations
  on the harddisk.
  The manual describes the installation steps in a clear way and installation
  is easy to perform.  Non-technical people can follow the installation steps
  without problems, but they may not understand all of the manual.

  Before the card is installed, a program TBINSTAL needs to be run. This
  program inspects the PC, checks for other adapters and outputs a
  recommended switchsetting for the card.

  I need to mention an oversight of the manufacturer where it comes to the
  ruggedness of the product.  The Thunderbyte card is simply plugged in an
  available slot in the PC, but it does not have a bracket to secure the card
  to the back of the PC chassis.
  The card merely sits in the bus connector without any additional mechanical
  support.  This will not pose a problem in desktop equipment, but carrying
  around a portable computer equiped with a Thunderbyte card is not
  recommended, the card may pop out of the bus connector, likely to cause sa
  short circuit.
  Switching the power on when the card is laying around in the computer may
  give some bad surprises.  Hopefully this will be fixed in a newer release of
  the product.

  Configuration of the card is well described in the manual.  All applicable
  switch settings are listed with a short but easy to understand comment.  To
  make things een more easy, the configuration program shows the recommended
  switch settings when run.

- Installation of the software merely consist of copying the file TBCONFIG.COM
  to the harddisk of the PC. TBCONFIG is normally not needed, but can be used
  to change the operation of the Thunderbyte card without the need of opening
  the computer. TBCONFIG can be loaded as a device driver, started from your
  AUTOEXEC.BAT or manually.
  English, German and Dutch versions of the programs are on the installation
  diskette and the Thunderbyte card changes the language of it's messages
  accordingly (nice touch!).

- Some other features are:
   * A startup password, which the user will be prompted for when the computer
     is powered on.
   * Booting from a diskette can be disabled completely to prevent people
     from using the machine if they do not know the password.
   * Booting from the B: diskette drive

All in all, the installation of the product is without problems, except for
the remark about the lack of a card mounting bracket.

There is an additional program is on the installation diskette: TBSCAN.COM, a
virus scanner which should be run from a known good DOS diskette to check for
viruses on your PC.  The program is simple and fast, but may give a false
sense of security.
TBSCAN, as with most virus scanners, can ONLY recognize the viruses it knows
about, i.e.  those viruses that are listed in the TBSCAN.DAT datafile.


2. OPERATION
------------

Once installed, the user will probably never notice the product, unless
something really odd happens.

Starting with a "clean" machine, I ran most of the computer viruses from my
collection against Thunderbyte. The card intercepted all of them.
Whenever Thunderbyte is suspicious about a write operation to disk, it will
pop a window with a warning text.  Depending on the configuration of the
card, you can select to let the operation continue or immediately abort it.

Also, write activity in the disk interface can be detected.  This detection
scheme is the reason for the funny cable that is installed between harddisk
and controller.  Whenever the WRITE line on the disk interface becomes active,
Thunderbyte will check if this write was triggered by a legitimate DOS call.
If not, the write will be intercepted.
This feature catches viruses and Trojan horse programs that try to mess up the
harddisk by directly manipulating control registers on the controller.

Writing to .COM files or to .EXE file headers will trigger Thunderbyte.
Programs like MicroSoft's EXEMOD and Incremental Linker change the header info
of .EXE files.  Presuming those programs are used by people that understand
what they are doing, this "false" alert will not really lead to unfounded
panic and formatting of disks that are suspected of being infested with
unknown viruses.

I found one odd problem with Thunderbyte.  The card sometimes intercepts a
legitimate FAT update by DOS as a BOOT sector modification.  After a talk with
the manufacturer of Thunderbyte, I found out the reason for this odd
behaviour:
This occurs only on disks that have been formatted in such fashion that the
FAT starts directly after the Partition Table of the disk.  Harddisks that
have been low-level formatted by the ROM routines of certain harddisk
controllers (Using DEBUG, G=C800:5,) or disks that were formatted by special
purpose device drivers may show this symptom.
ESSaSS will fix it in a future release of the Thunderbyte ROM code.

All in all, I'm impressed by Thunderbyte.  It has been installed in my
separate virus investigation computer for a number of weeks now and it has
caught all viruses I purposely ran on the machine and even some NEW viruses
that were hidden in files I received for inspection.

In short, Thunderbyte works.  However, 100% safety can never be guaranteed.
It is very hard to do and the change is extremely small, but it *IS* possible
that one day a smart virus writer will come up with an idea that will fool
Thunderbyte.  For the moment, however, it is one of the most sophisticated
anti-virus tools I have seen.
Software-only solutions will never reach the level of protection that this
card achieves.

3. COMMENTS
-----------

Positive:
 - Easy to install.
 - Simple to operate.
 - Uses very little RAM space.
 - Multilingual product.
 - Virtually invisible for the every day user.
 - A HARDWARE solution, not easy to break by malicious software.
 - No strange incompatabilities, except for the EXEMOD and Incremental Linker
   warnings, but those are probably unsolvable.

Negative:
 - No mounting bracket
 - For non-technical persons, some ppart of the manual may be too technical.
    Some more non-techie explanation may prevent unwanted panic about computer
    viruses. (i.e. "Educate the User!").
 - Only available for PC and PC/AT, no MCA version available (yet?).
 - Works only with PC-DOS and MS-DOS. Versions for Xenix, AIX and OS/2 would
   be nice, but these are environments were viruses are not (yet?) often seen.
 - The erroneous detection of BOOT sector modifications needs to be fixed!

<<
