Labs

InVircible stands out from the crowd partly due to its longevity - it was originally developed for the Israeli military in the early 1990s. However, what makes it even more unique is it doesn't rely on definition files - it's designed to look purely for virus-like behaviour. True, some vendors offer a heuristic scan mode, but InVircible is the only product of this type we've seen work.

For example, it checks scripts irrespective of their entry point and uses a weighting system that determines whether the code is malicious. The fact that it's a script scores against it, but if it tries to access an address book InVircible will simply stop it functioning. The same applies to macro viruses, as InVircible will look at the commands and decide whether they're attempting a dubious manoeuvre.

ADVERTISEMENT

The biggest advantage is that InVircible doesn't rely on downloads to allow it to recognise a new threat and is one of few proactive anti-virus products.

Installation isn't helped by a lack of good documentation, but this is because the price includes full on-site assistance for this phase. Clients are deployed with a logon script, and different scripts may be used to determine what access, if any, clients can have with the local Interceptor utility. An administration utility that can run on any version of Windows provides a comprehensive management interface where it's possible to view protected systems, check on viral activity, remotely run commands or programs on other systems and download and deploy software updates.

InVircible reacts differently to an infection, as, by its nature, it doesn't know or care what type of virus it has found, so it won't attempt to clean a file. It's designed primarily to offer complete transparency and will deny access, delete or rename the file and log the suspect user off the network if required. This philosophy also means reporting is kept to a minimum - InVircible will just send a broadcast and produce a report detailing its actions. Executable files may be restored using the Audit and Integrity Expert, as this takes a snapshot of critical information and uses it to return an infected file back to its original state.