Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: msb-ce@cup.portal.com Newsgroups: comp.virus Subject: Re: Virus scaners (PC) Message-ID: <0007.9106171414.AA16331@ubu.cert.sei.cmu.edu> Date: 13 Jun 91 06:57:53 GMT Sender: Virus Discussion List Lines: 22 Approved: krvw@sei.cmu.edu In a recent VIRUS-L posting Dennis Hollingworth said: > I tested McAfee's SCAN77 using Rosenthal Engineering's new > release of Virus Simulator (I've seen posted as VIRSIM11.COM > on EXEC-PC, Compuserve and others). It seems that SCAN77 > misses three boot sector viruses that SCAN76 found on > the same disk. Both versions of SCAN found nine viruses > in the .COM, four in the .EXE and seven in the test memory > virus. Since no real virus was present all of these "hits" could be regarded as false alarms, theoretically. We must be careful to distinguish what is being tested here. Just because a particular anti-viral product does not declare a particular test string to be a virus, we cannot say that the scanner has failed. A good case can be made for saying that the simulator failed. The only "test target" that can be used is the entirety of a virus, and at that point you no longer have a "simulator", you have the real thing. Fritz Schneider