This article is from the Viruses and the Mac FAQ, by David Harley D.Harley@icrf.icnet.uk with numerous contributions by others.
Symantec has a 30-day fully-functioning trialware NAV (Norton
AntiVirus for Macintosh). Update it with current definitions.
Network Associates has a 30-day fully-functioning evaluation
version of Virex 5.9.1. The Virex trial includes the application,
not the control panel.
Update the demo with current definitions:
Sophos also has a 30-day evaluation, also fully-functioning,
which includes the SWEEP application. The demo supports both
English and Japanese.
Intego has a limited-function French demo of Rival, "miniRival."
<http://www.intego.com/demo.html> [This seems to have disappeared,
along with Rival itself - 11-12-99]
Disinfector 1.0 is described by its author as shareware. However,
it's strictly speaking a limited-runtime demo -- it stops
functioning after 20 trial runs on one system. It's described as a
beta release, but the author expects users to register it at a
charge of $30 [subsequently reduced to $15]: in return, they get a
version which can be used an unlimited number of times. It only
detects a handful of Mac system viruses which the author claims
that commercial vendors have not detected, and have not been
reported in the wild. In the early days of virus/antivirus
technology, a number of utilities were made available which
addressed only one or a few viruses, and a proliferation of free
AutoStart worm detectors continues that honourable tradition.
However, charging for this particular utility puts it into the same
arena as the commercial scanners which detect a far wider range of
threats and for which full support is available, an area in which
it cannot at present compete. Disinfector was briefly available at
Info-Mac, but has since been removed.
[I suspect that this product has been removed from circulation, but
haven't checked with the author. This section will probably be amended
or removed in the next version of the FAQ, when I've checked.]
There have also been a number of proposals since John Norstad
announced the retirement of Disinfectant, suggesting that if the
code was made public, it would be possible to maintain and further
develop Disinfectant, possibly still as a freeware product. This is
misguided, for a number of reasons.
* It misses one of the main points of Norstad's announcement, which
is to acknowledge the dangers of continuing to develop a scanner
which detects only one class of virus, when so many people have
laboured so long under the misapprehension that it was a complete
* Disinfectant -has- been developed further. VirusScan is based on
Disinfectant technology (under licence), and NAI are in a much
better position to develop it as commercial-grade software than a
group of well-meaning individuals without the specialised skills
and resources of a mainstream anti-virus development team. Indeed,
it may be that the terms of that agreement would prevent Norstad
from making the code public even if he wanted to (I doubt that he
* Making the code public, even to a limited circle, would increase
the chances of its falling into irresponsible hands. In fact, the
online documentation has long stated that the code for the
detection engine is not available, though some of the interface
code was. (I'm paraphrasing from memory: I may well check out
exactly what it says for the next update of the FAQ.)
* To think that a committee of well-intentioned amateurs (or a
single ambitious amateur can develop Disinfectant to the same high
standard that it achieved through its lifetime demonstrates a
profound underestimation of the difficulties of maintaining (let
alone creating) a first-class known-virus scanner. [DH] Curiously,
the same fallacies have recently been been aired on a Unix virus