🚀 go-pugleaf

Hello Vesselin,

you write
[a ">>" means I write]

[...part about SCAN 97 missing representative samples from each set
of your MtE-based viruses deleted for brevity...]

>                           Unless, of course, you mean my previous
>message, in which I stated that SCAN 95b does NOT detect the MtE-based
>viruses in ANY infected EXE files AT ALL, which is also true.

Correct.  SCAN 95-B was released before we had any samples of
MtE-based viruses which infected .EXE files.  Detection was added in
V97 (the V96 release was skipped due to a Trojan horse).

>Regardless which of my messages you meant, they are both true and I
>have facts that prove both of them. If you consider my message about
>those facts to be alarmist, you are free to think so. Try to explain

Okay.

>it to your users. But please, don't object the facts. The facts are

I have been :-).  I don't believe I was objecting to your results.

>that SCAN is still unable to detect reliably ANY of the MtE-based
>viruses. It was my duty to warn its users about this.

[... my comments about MtE-based virus spread deleted...]

>I am not arguing about how widespread the MtE-based viruses are. They
>are not. What I am arguing about is that SCAN 97 is not able to detect
>reliably ANY of them. For a known virus, there is no such thing as
>99.8% detection. You either can detect it, or you cannot. Try

Are you sure?  I can see two opposing schools of thought forming here:
One of "all or nothing" detection (the binary operation school of
thought), and one of "percentages" of detecting (the analog school of
thought)?  Without getting too far off track, here, I believe that
there will be more "percentage" reports in the future, especially as
more complex forms of viral code emerge.

>explaining your users that they should not be alarmed, because SCAN
>misses "only" about one infected file in every 50. Besides, 319 missed
>samples of 15,994 is 98% (not 99.8%), i.e. one missed sample in every
                      ^^^^^^^^^^^^^^^
My mistake.  Sorry about that.

>50.

[...my suggestion for wording of reports deleted...]

>OK, I'll use this wording the next time. But I will not miss to say
>that "SCAN version xx missed X out of Y samples of the Z virus, which
>means that this version of SCAN is NOT able to detect the Z virus
>reliably. I've notified McAfee Associates of the problem and they will
>(hopefully) fix it shortly."

<GRIN>  Beautiful.

>> >an article posted somewhere (maybe even here), which described how
>> >McAfee Associates sponsored a particular set of anti-virus product
>> >evaluations and insisted that only old versions of the scanners of
>> >their main competitors were tested.
>
>> McAfee Associates has sponsored (that is, paid for) anti-virus product
>> testing by a number of independent organizations, using then-available
>> versions of competitors' anti-viral programs.  To do otherwise would be
>> worthless.
>
>More exactly, the article said that McAfee insisted that OLD versions

The article (I wish I knew which one) could have have said that.  It
does not mean that it is true, though.

>of the competitive scanners were used in those tests and that he was
>quoted saying that he wants his competitors to show worse results in
>such tests. To do otherwise might be worthless from the economical

I think its fairly easy to guess that John McAfee would like his programs 
to do better then anyone else's in a test.  I'm sure that is hardly
unique, though.

>point of view, but it would be honest from the human point of view...

[...deleted...]
>I hope so. This is one of the reasons for posting my message. Just
>have in mind that the bugs in security-related software (like
>anti-virus programs) are more dangerous. I'll do my best to continue
>reporting them.

If possible, would you mind sending me a copy of any such reports?  (Only
on McAfee Associates software, that is).  Thank you.

Regards,

Aryeh Goretsky
Technical Support

PS:  SCAN V99 should be available about the time you read this.  I'd
     be very interested in hearing how it does--the MtE-based virus
     detector was rewritten.  AG
- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET:
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | mcafee@netcom.COM
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
Support for SENTRY/SCAN/NETSCAN/VSHIELD/CLEAN/WSCAN/NETSHIELD/TARGET/CONFIG MGR