
    ͸
                                                             
          INFECTION COUNTDOWN - August/September 1995        
                                                             
    ;

    by David Smith, Antivirus researcher, Professional programmer
       Authorized vendor of TBAV and soon to be AVPRO antivirus
               Copyright 1995, All rights reserved
                    E-MAIL: saturn@airmail.net




                 We're now on the WORLD WIDE WEB!
           http://www.computek.net/autownet/countdown.html





                   SIX THOUSAND LIVE VIRUSES
                         FIVE SCANNERS
             go head-to-head in a fierce competition



This is a complete analysis of all the virus scanners.  All files were
integrity sealed, and downloaded directly from the Internet plus other
bulletin boards.  Over 6,000 viruses and TEN HOURS of scanning, I
bring you the real results from the real goodies.

Viruses used for the test:

1.  Russian collection
2.  Classic - (CrisBase) a well organized collection
3.  NCSA
4.  First Generation Collection


	Scanners used:

McAfee's SCAN version 2.2.5E (08/15/95)
AvPro 2.2 (registered) with update from 08/24/95
   ALARM! Mode was used for AVPRO (redundant scan disabled)
F-Prot 2.19
Tbav 6.36 (registered)
(I saw 6.37 on a weird board - a hack??)



	Batch File used:


AVP       /t /m /p /b /q /s /y /w=fvirs.ksp
F-PROT    /nomem /list /noboot /nowrap /old /report=fvirs.fpr
SCAN.EXE  /nomem /sub /rpterr /rptcor /report fvirs.sc2
TBSCAN    ld ba el ol lo ll=4 ln=fvirs.tbs



    BEFORE THE SCAN - COMMENTS
-------------------------------------------
Let me address the letters I've received last month:

1.  My comments are biased.

Answer:
Indeed they are!  Please don't read the comments section unless
you really want to hear them.   ;-)

2.  If I average the percentages horizontally for every scanner,
the results are inaccurate, and percentages shouldn't be used
to judge a scanner's accuracy.

Answer:
I don't average the scanner's percentages.  I merely judge which
one did better on which collection.  It doesn't take rocket science
to see McAffee's 50% detection rate is less superior than AVPRO's
93%    ;-)



My own comments about the playstation:

Does EVERYBODY read this thing???  I've gotten a ton of comments
from all sorts of people.  And I only upload it to a couple of
boards every month.  Geeez.

This report is the only one for August and September, 1995.
The Sony Playstation Game Console is coming September 9th,
and I will be too heavily involved in gameplay for a "Infection
Countdown" in September.  The PlayStation, with processor-pumping
500,000+ polygons and 30 frames of animation per second, will
revolutionize gameplay as we know it.  This hot game-master can
out-do EVERYTHING on the market, and makes the Gensis/Saturn
look like play-toys.

Buy your Playstation today!






THE RESULTS:
------------------------------------------------------------------------



	LAYOUT BY FILES:


      Russian   NCSA   1STGen
#       1443    2157    3100

AVPRO   1416    1921    2808
TBSCAN  1279    2054    3043
F-PROT  1308    1960    3055
McAfee  1193    1889    2736




	LAYOUT BY PERCENTAGE:

      Russian   NCSA   1STGen

AVPRO   98.1    89.0    90.5
TBSCAN  88.6    95.2    98.1
F-PROT  90.6    90.8    98.5
McAfee  82.6    87.5    88.2







  AFTER THE SCAN - ANALYSIS (My biased comments!):
-------------------------------------------------

Avpro, as usual, pounced the Russian collection with ease.
However, it choked hard on the others, and BARELY scored
higher than McAfee's SCAN (ick-what a thought)

TBSCAN and F-PROT are neck-and-neck up there!  They
scored a close tie on 1StGen, and evened out amongst
the other collections.


Conclusion:

I need to add more collections (I have plenty more  ;-)
so we can see through the long stretch, who comes out
ahead.  But for now:


RECOMMENDED SCANNER:

TBSCAN or F-PROT - take your pick



CUDOS of the Month:

AVPRO, for finding the new Microsoft Word virus (the
macro that spreads itself around like a virus) and
releasing AVPLITE for the masses.














 ================================================
  FIRST GENERATION COLLECTION
 ================================================
-----  F-PROT Virus Scanner Results  -----
Results of virus scanning:

Files: 3339  (10.1 MB)
Scanned: 3059  (9.0 MB)
Infected: 3055
Suspicious: 1
Disinfected: 0
Deleted: 0
Renamed: 0

No boot sectors were scanned.

Time: 5:07

-----  McAfee's Scan Virus Results  -----
Summary report on E:\1ST_GEN\*.*

File(s)
	Analyzed: ..............    3339
	Scanned: ...............    3083
	Possibly Infected: .....    2736
Time: 00:05.57

-----  ThunderByte Virus Scanner Results  -----
Found 3337 files in 581 directories, 3100 files seem to be executable.
0 files were checked for changes, 0 files have been changed.

3043 files are infected by one or more viruses



-----  AVPRO Virus Scanner Results  -----
Statistics:
       Detected:  2808 bodies of
                  2067 viruses

       Warnings:    20
     Suspicious:   151

        Scanned:  3059 files
                   581 directories
                  9202 Kbytes
      Scan time:     0:09:05
          Speed:    17 Kb/sec







 ================================================
  NCSA OLDER COLLECTION
 ================================================
-----  F-PROT Virus Scanner Results  -----
Results of virus scanning:

Files: 2157  (12.3 MB)
Scanned: 2157  (12.3 MB)
Infected: 1960
Suspicious: 4
Disinfected: 0
Deleted: 0
Renamed: 0

No boot sectors were scanned.

Time: 2:45

-----  McAfee's Scan Virus Results  -----
Summary report on E:\NCSA\*.*

File(s)
	Analyzed: ..............    2157
	Scanned: ...............    2157
	Possibly Infected: .....    1889
Time: 00:03.31

-----  ThunderByte Virus Scanner Results  -----
Found 745 files in 3 directories, 745 files seem to be executable.
0 files were checked for changes, 0 files have been changed.

627 files are infected by one or more viruses



-----  AVPRO Virus Scanner Results  -----
Statistics:
       Detected:  1921 bodies of
                   630 viruses

       Warnings:     2
     Suspicious:    27

        Scanned:  2157 files
                   132 packed
                     3 directories
                 12676 Kbytes
      Scan time:     0:07:21
          Speed:    29 Kb/sec



 ================================================
            RUSSIAN COLLECTION
 ================================================
-----  AVPRO Virus Scanner Results  -----
Statistics:
       Detected:  1416 bodies of
                   509 viruses


        Scanned:  1433 files
                    11 packed
                     3 directories
                  4773 Kbytes
      Scan time:     0:08:18
          Speed:    10 Kb/sec




-----  F-PROT Virus Scanner Results  -----
Results of virus scanning:

Files: 1433  (4.6 MB)
Scanned: 1433  (4.6 MB)
Infected: 1308
Suspicious: 17
Disinfected: 0
Deleted: 0
Renamed: 0

No boot sectors were scanned.

Time: 3:56

-----  McAfee's Scan Virus Results  -----
Summary report on E:\RUSSIA\*.*

File(s)
	Analyzed: ..............    1433
	Scanned: ...............    1429
	Possibly Infected: .....    1193
Non-critical Error(s):                 1
Time: 00:06.31

-----  ThunderByte Virus Scanner Results  -----
Found 1399 files in 3 directories, 1225 files seem to be executable.
0 files were checked for changes, 0 files have been changed.

1279 files are infected by one or more viruses






