Resident Scanners

A TSR is a program that loads into memory, then becomes inactive, allowing some other program to run. Certain keypresses will activate or de-activate a given TSR, and some permit a keypress to remove them from memory. Popular TSRs include network drivers, spoolers, cache memory, and various pop-up menu systems, help systems, appointment books, calculators, and other desktop utilities.

A scanner can be written as a TSR. While the idea is a good one, the actual implementation problems leave the approach inferior in many situations. Resident scanners are burdened with all the problems of resident software, and all the problems of scanning.

- Many microcomputer configurations are intolerant of TSRs, and crash, lockup, or misbehave. The factors which interfere are numerous, but usually involve a conflict with other TSR's the user loads.
- All TSRs use RAM, and most use conventional memory -- addresses below 640K -- something which is in very short supply in today's micros. The addition of another TSR to your system may interfere with the operation of some other large program.
- Resident scanners often resort to very short scan strings, to conserve memory. As a result, they false alarm. Any resident scanner which provides the user with many false alarms will be seen as a nuisance, and likely be de-activated. A poorly designed resident scanner can provide the software equivalent of the boy who cried wolf.
- Any resident scanner can, in theory, be easily detected by viruses, and disabled or removed. Most viruses, of course, do no such thing, but many do. The result is that users of some resident scanners have a false sense of security.
- A resident scanner is not be able to prevent a boot sector infection, since the infection occurs before the scanner is even loaded, as in an accidental boot from a disk in A:.
- It is simple to write a virus that evades the interrupt vectoring capabilities of a resident scanner in a DOS environment.

Because of these limitations, we are not particularly enthusiastic about this approach.