Re: Virus scaners (PC)

Article View: comp.virus

Article #4535

#4535

From: msb-ce
Date: Thu, 13 Jun 1991 06:57

22 lines
1436 bytes

In a recent VIRUS-L posting Dennis Hollingworth <holly@fifi.isi.edu> said:

 > I tested McAfee's SCAN77 using Rosenthal Engineering's new
 > release of Virus Simulator (I've seen posted as VIRSIM11.COM
 > on EXEC-PC, Compuserve and others).  It seems that SCAN77
 > misses three boot sector viruses that SCAN76 found on
 > the same disk.  Both versions of SCAN found nine viruses
 > in the .COM, four in the .EXE and seven in the test memory
 > virus.

Since no real virus was present all of these "hits" could be regarded
as false alarms, theoretically. We must be careful to distinguish what
is being tested here. Just because a particular anti-viral product
does not declare a particular test string to be a virus, we cannot say
that the scanner has failed. A good case can be made for saying that
the simulator failed.

The only "test target" that can be used is the entirety of a virus,
and at that point you no longer have a "simulator", you have the real
thing.

Fritz Schneider

Technical Details

Message-ID: <0007.9106171414.AA16331@ubu.cert.sei.cmu.edu>

Path:

arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: msb-ce@cup.portal.com
Newsgroups: comp.virus
Subject: Re: Virus scaners (PC)
Message-ID: <0007.9106171414.AA16331@ubu.cert.sei.cmu.edu>
Date: 13 Jun 91 06:57:53 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 22
Approved: krvw@sei.cmu.edu