Comparison between Mcaffe's SCAN.EXE (3-25-92) and F-PROT.EXE (4-5-92) by THE RESEARCHER & Scan Man Acknowledgements to Invalid Media for the virus collection used in this experiment. I thought it would be fun to turn a couple of good virus scanners loose on a collection of hundreds of active viruses and see what happened. It was. As you all know we have no way of knowing what virus scanners are of what quality. This is need to know information! Preliminary testing indicated the two best scanners were McAfee and F-Prot. So these were the only two used in the final testing. It should also be noted that F-Prot has the best information i.e. descriptions we have found so far. The results are tabulated below for those interested. ------------------------------------------------------------------------------ Total files = 609 Executables = 497 Number of files found containing viruses: SCAN.EXE - 387 F-PROT.EXE - 399 (Also found 5 trojans, 1 joke program - not included in count) Infected files found by SCAN not found by F-PROT = 16 Infected files found by F-PROT not found by SCAN = 27 Number of executable files with nothing found by either scanner = 70 List of the files where nothing was found ----------------------------------------- AMUSAK.EXE FESTER.EXE MNDRT2_.COM SILVER.COM ANTIMIT.COM FER121V1.EXE MSK.COM SILVER2A.COM VIRUS.EXE RUNNOW!.COM MUTATOR.EXE SILVER2B.COM BOBINST.COM GEEK.COM MUTTINY.COM SILVER2D.COM SENDDISK.EXE GERMAN.EXE MICRO29.COM SILVER3B.COM FASTCOMP.EXE HR.COM ALLIANCE.COM SPIN.COM CODEZERO.COM HIGHLAND.COM NONT-512.COM SUPER.COM COOKIE.EXE UNLOCK.COM NMAN-D.EXE SURFER.COM CRAPS.EXE MOUSE.COM OTTO.COM SENECA.COM CRF.COM SETUP.EXE ORION.EXE SKISM808.COM CYBERNET.COM TPC.COM PEBBLE.COM SUIC-A.COM DCIMP.COM J-INJECT.EXE POL529.COM TONY-B.COM DUTCH555.EXE KINNISON.COM RUNNOW!.COM TSOTL-B.COM ENGLAND.COM KKK.EXE PCBB.COM ULTRAV.COM EXPLODE.COM LENGTH2.EXE ROULETTE.EXE V1-NOT!.EXE EBV.COMS MAKOR.EXE ROCKO-C.COM VIOLB1.EXE FRID13V3.EXE MD-VIRUS.COM SECRET.COM FRID13V4.EXE MITHRAND.COM SEOUL.COM List of infected files found by SCAN not found by F-PROT -------------------------------------------------------- AIDS.COM BEAST.COM BUSTED.COM CREEPER.COM CVIRUS.EXE DC-B.COM DEADPOOL.COM EMFII.COM MF.COM MINISCUL.COM MUNNICH.COM PETERBRG.COM PSYCHO.COM SCREAMII.COM SHHS.COM VIRI.COM List of infected files found by F-PROT not found by SCAN -------------------------------------------------------- ANTIC10K.COM OMEGA.COM HARAKI2.EXE OSSZES.COM INTRUDER.EXE PARAST2B.COM ITTI-A.COM PS!KO-C.COM ITTI-B.COM SAD.COM JOSHI_A.COM SKISM14.COM LM.COM STONED_A.COM LOCK_UP.COM SUCCUBUS.COM MALMSEY.COM SUOMI.COM MGTU.COM TESTER.COM MICHEL.COM TIMID.COM MINISTRY.COM TORMENT.COM MUTANT.COM VERSIKEE.EXE NOV17-B.COM These files were reported by both scanners as infected ------------------------------------------------------ 2480-2.COM DR20.COM MAGN2560.COM SKISM4.COM 4096.COM DR23.COM MAKESTND.COM SKISM5.COM ADOLPH.COM DROPPER2.COM MALMSEY.COM SKISM6.COM ADVENT.COM DRQUMAK.COM MALTESE.COM SKISM7.COM AGIPLAN.COM DURBAN.COM MANOWAR.COM SKISM8.COM AIRCOP2.COM EMULATE.EXE MARAUDER.COM SKISM9.COM AKUKU.COM ENIGMA.COM MEM.COM SLAYER.COM AMBULANC.COM EUROPE92.COM MENDOZA.COM SLOW.COM AMILIA.COM EVIL-D.COM METAL.COM SMOB1A.COM AMOEBA-2.COM EVIL.COM MG-1.COM SOCHA.COM AMOEBA.COM EXTERM.COM MG-2.COM SORRY.COM AMST-299.COM FATHERCH.COM MG-3.COM SORTINFT.EXE AMST-345.COM FEAR.COM MG-31.COM SPYER.EXE AMST-740.COM FELLOW.EXE MG-4.COM STAF.COM AMST-847.COM FINGER.COM MGTU.COM STAR801.COM AMST-850.COM FIRE.EXE: MICHEL.COM START.EXE: AMST-852.COM FISH.COM MICRO128.COM STONED-X.COM AMSTRAD.COM FISH2.COM MIGRAM.COM STONED_A.COM ANARKIA1.COM FLASH.COM MINISTRY.COM SUBLI110.COM ANSI.COM FLIP.EXE MIR.COM SUCCUBUS.COM ANTHRAX.COM FLIP2343.COM MIX-1.EXE SUNDAY.COM ANTIC10K.COM FRERE.COM MIX2.COM SUOMI.COM ANTICST.COM FREREJ.COM MLASMLAS.COM SURIV-2.COM ANTIFAG.COM FROGS.COM MLTI.COM SVC1064.COM ANTIFIRE.COM FUCKYOU.COM MLTI830.COM SVC1689.COM AP-400.COM FUMANCHU.COM MULTI.COM SVC50.COM AP-440.COM GERGANA.COM MURPHY.COM SVC60.EXE AP-480.COM GHOST.COM MURPHY2.COM SVERDLOV.COM AP-529.COM GOBLIN.COM MURPHY3.COM SWAMI.COM AP-605.COM GREEMLIN.COM MUTANT.COM TAIWAN.COM APOC.COM GRITHER.COM NAZI.COM TAIWAN2.COM APOCII.COM GRLINKS.COM NECROP.COM TEQUILA.COM ARF-B.COM GUPPY.COM NENIGMA.COM TERROR.COM ARMAGEDO.COM HAHA.COM NEWYEARS.COM TESTER.COM ASSIGN.COM HALLOE.COM NINA.COM TIMID.COM AT144.COM HAPPY.EXE NJERU.COM TINY-133.COM BACKTIME.COM HARAKI2.EXE NOINT.COM TINY-134.COM BADBOY.COM HELL-B.COM NOMENCLA.COM TINY-138.COM BADBOY2.COM HERO.COM NOV17-B.COM TINY-143.COM BADTASTE.COM HIV.COM NPLAGUE.COM TINY-154.COM BANDIT.COM HOLLAND.COM NPLAGUE.COM TINY-156.COM BB.COM HOLLANDB.COM NTKC-B.COM TINY-158.COM BEBE.COM HORSE.COM OMEGA.COM TINY-159.COM BEEPER.COM HORSE2.COM ONTARIO.COM TINY-160.COM BEST.COM HORSE3.COM OROPAX.COM TINY-167.COM BLJEC3.COM HORSE4.COM OSSZES.COM TINY-198.COM BLJEC4.COM HORSE5.COM PARASITE.COM TINY.COM BLJEC5.COM HORSE6.COM PARAST2B.COM TINY198.COM BLJEC6.COM HYBRYD.COM PARIS.COM TINYC.COM BLJEC7.COM HYDRA0.COM PARITY.COM TINYD.COM BLJEC8.COM HYDRA1.COM PARSITE2.COM TINYFV11.COM BLJEC9.COM HYDRA2.COM PATRICIA.COM TORM-D.COM BLOOD.COM HYDRA3.COM PAYDAY.COM TORMENT.COM BMONDAY.COM HYDRA4.COM PERFUME.COM TP16VIR.COM BOBVIRUS.COM HYDRA5.COM PHANTOM.COM TP33VIR.COM BOMB.EXE HYDRA6.COM PHENOME.COM TP34VIR.COM BOYS.COM HYDRA7.COM PHOENIX.COM TP38VIR.COM BRENDA.COM HYDRA8.COM PIXEL.COM TRACEBAK.COM BRK.COM HYMN.COM PIXIE.COM TUMEN05.COM BURGER.COM HYMNP.COM PLASTIQ.EXE TUMEN20.COM BUSH.COM ICELAND3.EXE POGUE.COM TUQ_VIR.COM CANCER.COM IKV-528.COM POL-217.COM TURBO99.COM CARIOCA.COM INCOM.COM POLIMER.COM TYPO.COM CASCADE.COM INFINITI.COM POLISH.EXE TYPO2.COM CASPER.COM INTRO.COM PRETORIA.COM V2000-2.COM CATMAN.COM: INTRUDER.EXE PROUD.COM V2100.COM CEMETERY.COM IRAQUI.COM PRTSCR.COM V299.COM CIA.COM ITTI-A.COM PS!KO-A.COM V2P6.COM CLR.COM ITTI-B.COM PS!KO-B.COM V600.COM COOKIE.EXE JERSLM-E.EXE PS!KO-C.COM V800.COM CRIMEIIB.COM JERSPAIN.COM PS!KO.COM V801.COM CRZYEDIE.COM JERSPAIN.COM PSQR.COM VACSINA.COM D-DANCE.COM JERU-B.COM RAPE-10.COM VCS.EXE: D-FX.COM JERUB-I2.COM RAPE-11.COM VENG.COM D-FX2.COM JOJO2.COM RAPEINFO.COM VERSIKEE.EXE DAMAGE.COM JOSHI_A.COM RAUBKOP.COM VHUCOM.COM DAMIEN.COM JULY13.COM RAV.COM VIENNA.COM DARTH-2.COM JUSTICE.COM RAV.EXE VIENNA.EXE DARTH.COM KAMASYA.COM RMIT.COM VIOL-B3.COM DARTH2.COM KAMIKAZE.COM ROSTOV.COM VIOL-D.COM DARTH3.COM KENNEDY.COM RUSSIA.COM VIOL.COM DARTH4.COM KEYDROP.COM SAD.COM VIOLATOR.COM DATALOCK.COM KIEV493.COM SARATOGA.COM VIPER.COM DAVEN-B.EXE LABEL.COM SATHANYC.COM VIRUS101.COM DAVID.COM LEECH.COM SCOTTSV.COM VORONEZH.COM DBASE.COM LEPROSY.COM SCREAMER.COM WESTWOOD.COM DC-1168.COM LEPROSYB.COM SDOT-789.EXE WHALE.COM DEATHCOW.COM LEPROSYD.COM SENT-3.COM WIGGER.COM DEFINE.COM LEPROSYD.EXE SENT-5.COM WOLFMAN.COM DEICIDE.COM LIBERTY.COM SENTINEL.COM WORD1069.COM DEMO.EXE: LISBON.COM SEX11.COM WORD1085.COM DEMON.COM LISBON2.COM SEXUAL.COM WORD1387.COM DESTI.COM: LM.COM SHAKE.COM WORD1503.COM DESTRUCT.COM LOCK_UP.COM SILENCE.COM WWT-01.COM DIABOLIK.COM LOVECHLD.COM SKISM.COM WWT-02.COM DIAMOND.COM LOZ-1018.COM SKISM10.COM XMAS-J.COM DIR.COM LOZ-1023.COM SKISM11.COM YANKEE.COM DIRII.COM LOZINSKY.COM SKISM12.COM ZELENG.COM DONOTHIN.COM MACHO-A.COM SKISM14.COM ZEROBUG.COM DOOMII.COM MACHO.COM SKISM2.COM ZK900.COM DOTKILL.COM MAGN2048.COM SKISM3.COM Downloaded From P-80 Systems 304-744-2253