🚀 go-pugleaf

mcafee@netcom.com (McAfee Associates) writes:

> SCAN missed 317 out of 15,996 viruses, or about 0.02% of the samples.  
> Rather than post the "alarming" results, do you not think a message to
> myself (or better yet, to one of our programmers) would have sufficed?

First, SCAN missed 319 out of 15,994 replicants of 7 viruses. Second,
between the missed replicants there were representatives of EACH of
those 7 viruses, which proves that SCAN was unable to detect reliably
ANY of those 7 viruses. Even if we accept the excuse that you didn't
have some of them (which is unacceptable, because I already explained
how they all could be trivially detected, even if you don't know
them), do you mean that you didn't have ANY of those 7 viruses?

For me the above means that SCAN 97 is NOT able to detect -reliably-
ANY of the currently existing MtE-based viruses. And this is exactly
what I said in my message. Unless, of course, you mean my previous
message, in which I stated that SCAN 95b does NOT detect the MtE-based
viruses in ANY infected EXE files AT ALL, which is also true.

Regardless which of my messages you meant, they are both true and I
have facts that prove both of them. If you consider my message about
those facts to be alarmist, you are free to think so. Try to explain
it to your users. But please, don't object the facts. The facts are
that SCAN is still unable to detect reliably ANY of the MtE-based
viruses. It was my duty to warn its users about this.

> A detection rate of approximately 99.8% on a virus, or set of MtE-based
> viruses does not seem especially bad, in lieu of the fact that we have
> not received any confirmed reports of the virus yet [outside of virus-
> exchange BBS's and the like].  

I am not arguing about how widespread the MtE-based viruses are. They
are not. What I am arguing about is that SCAN 97 is not able to detect
reliably ANY of them. For a known virus, there is no such thing as
99.8% detection. You either can detect it, or you cannot. Try
explaining your users that they should not be alarmed, because SCAN
misses "only" about one infected file in every 50. Besides, 319 missed
samples of 15,994 is 98% (not 99.8%), i.e. one missed sample in every
50.

> Next time, perhaps you could check with us about your results?  I think
> it would be more appropriate to say "SCAN missed X out of Y samples of
> the Z virus.  I've notified McAfee Associates of the problem and they
> will (hopefully) fix it shortly." than your earlier post, which seemed
> rather alarmist to me.

OK, I'll use this wording the next time. But I will not miss to say
that "SCAN version xx missed X out of Y samples of the Z virus, which
means that this version of SCAN is NOT able to detect the Z virus
reliably. I've notified McAfee Associates of the problem and they will
(hopefully) fix it shortly."

> >an article posted somewhere (maybe even here), which described how
> >McAfee Associates sponsored a particular set of anti-virus product
> >evaluations and insisted that only old versions of the scanners of
> >their main competitors were tested.

> McAfee Associates has sponsored (that is, paid for) anti-virus product
> testing by a number of independent organizations, using then-available
> versions of competitors' anti-viral programs.  To do otherwise would be
> worthless.

More exactly, the article said that McAfee insisted that OLD versions
of the competitive scanners were used in those tests and that he was
quoted saying that he wants his competitors to show worse results in
such tests. To do otherwise might be worthless from the economical
point of view, but it would be honest from the human point of view...

> >> I note that several other anti-viral
> >> packages such as NAV, CPAV, Untouchable, Novi are not mentioned at all.
> >
> >I don't have a copy of Novi. And, unlike your product, all the
> >products mentioned above are not shareware - they are all commercial,

> True, but they all of them are also widely-used, at least here in
> America.  In Europe, I would imagine that Dr. Solomon's AVTK is used
> more widely, etc.

You didn't quote me entirely. I also pointed out that

> >so I obviously cannot easily get the latest versions as quickly as
> >with your product. Besides, I am only a human and cannot do everything

You see? The main problem for me is that I cannot obtain up-to-date
copies of the commercial software as easy as of yours. Besides, NONE
of the commercial programs are so widely used as yours. Even in
Europe... That's why, the bugs in your program have more potential to
cause damage than the bugs in the other programs.

> >I am doing my best to provide the most complete data possible to the
> >users. So does the rest of the VTC-Hamburg. What has been observed in
> >SCAN 95b was a BUG, that's why I was precipitated to publish the
> >information about it. Or do you want to hide from your users that a
> >particular (even if not the latest) version of your program is buggy
> >and provides a false sense of security?
> [...rest of message deleted...]

> Bugs can be fixed.  

I hope so. This is one of the reasons for posting my message. Just
have in mind that the bugs in security-related software (like
anti-virus programs) are more dangerous. I'll do my best to continue
reporting them.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany