ThunderByte Antivirus

» see thunderbyte.com as it lived, on the wayback machine

~ the eulogy ~

Frans Veldman wrote it in the Netherlands and started shipping it in 1988 through ESaSS, his own company. The suite was a handful of small DOS executables with blunt names: TbScan looked for infections and TbClean tried to repair them. The one that gave the product its character was TbSetup, which walked your drive and wrote a checksum of every executable into files called Anti-Vir.Dat, so that on the next pass the scanner could say which files had actually changed instead of guessing. The whole thing fit on a floppy with room left over.

Two things made it stand out. The first was raw speed. TbScan was written tight enough that it went through a hard disk noticeably faster than its competitors, which mattered enormously on hardware where a full pass over the disk could otherwise run for twenty minutes. The second was that it did not depend entirely on knowing the virus in advance. Veldman built a heuristic analyzer that examined what a program's code was structured to do, flagging things like direct writes to the boot sector or code that decrypted itself before running, and reported a string of one-letter flags rather than a name.

That was a real departure in the early nineties, when the standard model was a signature database that could only recognize things somebody had already caught and dissected. It also produced false positives, and there was a long-running argument in the antivirus press about whether telling a user that a file was suspicious without being able to name the threat was help or noise. ThunderByte shipped it anyway, along with a hardware option: an ISA card that loaded protection before the operating system did, on the theory that software booting after a boot sector virus has already lost.

It ended in 1998, when Norman ASA of Norway bought ESaSS and retired the product as a standalone thing, keeping what it wanted from the engine. That is the same year I got a modem, so ThunderByte was already historical by the time I could have downloaded it. What I arrived into was the Norton and McAfee duopoly on retail shelves, with the interesting European scanners surviving as names in magazine comparison tables.

~ the dossier ~

~ the origin ~

Shareware was the distribution model, and for a DOS utility from a small Dutch company it was the only one that could have worked. The archive spread through bulletin boards and, later, the cover disks stapled to computer magazines. You did not buy it from a shop. You got it from somebody, ran it, and paid ESaSS later if you were the paying kind.

The competitive era it belonged to is easy to forget now. There were dozens of serious scanners, most written by one or two people who knew the virus scene personally, and Virus Bulletin's comparative tests were read like sports results. Detection rate mattered, but so did how much conventional memory the resident monitor stole from your games. ThunderByte won on the cheapness of running it, consistently enough to build a following on speed alone.

~ the postmortem ~

Nothing dramatic happened. Norman bought ESaSS in 1998 and the ThunderByte name went into the folder where acquired brands go. There was no final version anyone remembers, no announcement that reached users, just a product that stopped being updated while a Norwegian company absorbed its engineering.

The specific reason it could not have survived alone is worth stating plainly. Signature-based defense is a logistics business: you need people collecting samples around the clock and shipping updates faster than the things spread. That is affordable at scale and impossible for a small European shareware operation once the internet made distribution instant. Veldman's heuristics were the right idea, arrived at early, by an outfit too small to fund the boring half of the work that has to run alongside them.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »