🚀 go-pugleaf

Hello Vesselin,

you write:
[...my comments about release dates on V95 and V97 deleted...]
[The ">>" indicates comments from me.]

>When the preliminary tests were done, the latest available version of
>SCAN was 95b. Since the results were alarming, I decided that it is my
>duty to inform the users about a particular deficency in the then
>latest version of the product. Even if a newer version of the product
>were available (which it wasn't then), and even if it were able to
>detect the MtE-based viruses reliably (which it still isn't, see
>below), my message would alarm the users to urgently upgrade to the
>newer version. I still think that there is nothing incorrect in what I
>have done.

SCAN missed 317 out of 15,996 viruses, or about 0.02% of the samples.  
Rather than post the "alarming" results, do you not think a message to
myself (or better yet, to one of our programmers) would have sufficed?

A detection rate of approximately 99.8% on a virus, or set of MtE-based
viruses does not seem especially bad, in lieu of the fact that we have
not received any confirmed reports of the virus yet [outside of virus-
exchange BBS's and the like].  

[...comments about detection of MtE-based viruses added in SCAN V97 
from myself and your comments about downloading V97 deleted...]

>The results are rather poor - they clearly show that version 97 of
>SCAN is not able to detect reliably ANY of the MtE-based viruses too.
>I have proven this to you, by sending you a batch of examples that

Yes, you have, and I am not so much questioning this as the manner in
which it was reported.

>SCAN 97 was unable to detect. I have also offered to help you fixing
>the problem and even suggested an easy solution for the other 284
>missed samples. What do you want more?

Next time, perhaps you could check with us about your results?  I think
it would be more appropriate to say "SCAN missed X out of Y samples of
the Z virus.  I've notified McAfee Associates of the problem and they
will (hopefully) fix it shortly." than your earlier post, which seemed
rather alarmist to me.

>> I can understand your desire to provide the readers of comp.virus with
>> timely, accurate information about the efficacy of different anti-viral
>> packages, however, posting one message decrying the deficiencies of
>> one brand of software with an endnote about other packages sounds less
>> like a genuine attempt at impartial research and more like alarmist scare
>> tactics, or even worse, marketing :-) 
>
>It's very strange to see the above posted by someone from McAfee
>Associates... Even if we don't pay attention to the fact that it does
>not correspond to the truth (as I explained above), I still remember

You did download V97 of SCAN as fast as you could and repeat your
tests, which I find commendable.  Even if I don't agree with how
you reported the results.

>an article posted somewhere (maybe even here), which described how
>McAfee Associates sponsored a particular set of anti-virus product
>evaluations and insisted that only old versions of the scanners of
>their main competitors were tested.

McAfee Associates has sponsored (that is, paid for) anti-virus product
testing by a number of independent organizations, using then-available
versions of competitors' anti-viral programs.  To do otherwise would be
worthless.

>> I note that several other anti-viral
>> packages such as NAV, CPAV, Untouchable, Novi are not mentioned at all.
>
>I don't have a copy of Novi. And, unlike your product, all the
>products mentioned above are not shareware - they are all commercial,

True, but they all of them are also widely-used, at least here in
America.  In Europe, I would imagine that Dr. Solomon's AVTK is used
more widely, etc.

>so I obviously cannot easily get the latest versions as quickly as
>with your product. Besides, I am only a human and cannot do everything

As am I. [Shut up, Spencer]

>at once. In fact, the MtE tests even of your product were made
>possible mainly because two visiting students from Rostok spent a lot
>of time to generate 16,000 naturally infected samples (do you
>understand what all this means, having in mind that some of the
>MtE-based viruses infect only 2-3 samples in the current directory and
>do not go resident?), and one of our students urgently ran two tests
>(with version 95b and 97 of SCAN) and summarized the results...
>
>I -will- publish MtE detection data for 17 scanners, each of which
>claims (like yours) that it is able to detect all MtE-based viruses

Hopefully they will be published together at once.

[Moderator's note: Vesselin's MtE tests are available from:
   cert.org:pub/virus-l/docs/mtetests.zip
   ftp.informatik.uni-hamburg.de:pub/virus/texts/tests/mtetests.zip
For those without FTP access to the net, I have broken Vesselin's
tests down into multiple chunks and will be posting each separately.]

>with 100% reliability... As I said, I don't know about Novi, because
>I don't have it, but NAV 2.1, CPAV 1.3, and UTScan 23.00.12 (the
>scanner part of the Untouchable, since Untouchable is mainly an
>integrity-based product) all failed the test - just like SCAN 97, they
>turned out to be unable to detect all MtE-based viruses used during
>the test reliably.
>
>> In any case, I would strongly suggest that you complete your research in 
>> the future before posting incomplete results.  
>
>I am doing my best to provide the most complete data possible to the
>users. So does the rest of the VTC-Hamburg. What has been observed in
>SCAN 95b was a BUG, that's why I was precipitated to publish the
>information about it. Or do you want to hide from your users that a
>particular (even if not the latest) version of your program is buggy
>and provides a false sense of security?
[...rest of message deleted...]

Bugs can be fixed.  Bearing in mind that I am, after all, a McAfee
Associates employee, I believe that McAfee Associates (and myself) have
been very forthcoming to users about reporting bugs, fixing them, and
suggesting workarounds while the bugs do get fixed.

Regards,

Aryeh Goretsky
Technical Support
- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET:
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | mcafee@netcom.COM
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
Support for SENTRY/SCAN/NETSCAN/VSHIELD/CLEAN/WSCAN/NETSHIELD/TARGET/CONFIG MGR