========================================= File 8PROBLMS.TXT List of problems experienced during test: ========================================= Formatted with non-proportional font (Courier) For automatic tests on huge viral databases, and for automatic processing of large scanner log files, a set of test conditions is prerequisite for scanners to participate in a VTC test (see: 4TESTCON.TXT). In most cases, serious problems were observed during some test. DOS scanners were either not suitably running under SIMBOOT and crashed, or problems appeared with the (rather large) file virus database. In some cases, scanners crashed upon detecting some specific virus; in few cases, "manual" operation instead of automatic (batch) operation helped solving some of these problems. Such curative action was also applied when possible in cases where log files were inadequate (e.g.needing manual operation for export). A general problem with DOS scanners is related to counters for files and viruses which often seem to be designed as integers, so they start after 65,536 with 0. During preparation and test, we experienced a very serious problem evidently a bug in Windows-NT, according to which management of large sets of directories in FAT and NTFS may not reliably work. Both when attempting to move large parts of our file virus database, as when some scanner proceeded scanning subsequent viral directories, we found that several directories were not moved or touched. This effect seems to happen stochastically, such that subsequent attempts gave different results. Concerning omitted (=unscanned) directories, we overcame this "dysfunctional" behaviour of FAT and NTFS by repeat- ing scanning so long until the number of scanned files agreed with the (known) number of directories in testbeds. Overcoming this problem was extremely time-consuming, and this was the major reasons for delaying publication of results. In cases where scanners crashed during detection test upon the rather large file virus database, tests were performed in several runs on partitions (essentially on directories with same first letters of names). In most cases (apart those reported below), these tests were completed, and resulting files were joined. Some scanners could be tested *without any problem*. Such benevolent behaviour was esp. observed with products of the following producers: "No problems at all" (except possibly NFTS and FAT problem): ****AVP,AVS,FMA,FPR,IBM,PAV,SWP,TBAV**** "Scanner could not detect packed files": DOS: ANT,AVS,ITM,IVB,FWN,SCN,TBAV,VBS,VET,VSP Win 95/98/NT: ANT,INO,IRS,IVB,FWN,HMV,TBA,VBS In detail, the following problems have been encountered with different scanners during the tests: Accura: WinNT: Crashed on one "Goodware" File (R:\word\sk__fp__\superbook.dot) Anyware: DOS: Many Crashes (Runtime Error 216), Can only be used upon GUI Win95: Crashed completely while scanning file viruses, with error "unable to insert a line" Win98: Crashed at file test completely; crashed twice at compressed file virus test AntiVir: Win95: Crashed once at macro malware test Win95/98: Interrupted scanning at some viruses to ask user to send in the infected file (violation of test condition A4) Win98: Crashed once at compressed files test AntiVirenKit: Win98: Crashed on some viruses in file virus test (Ravel,ps-mpc). Crashed also at end of run AVG: DOS: Switch didnot work Dr Solomon's AV Toolkit: Win95: Crashed twice at file test Win98: Crashed once at file test F-SECURE: Win95: Crashed at file virus and packed file tests completely, crashed at malware test once. Win95/98: Reported error "Test failure:(rc>=0) at source\ureplbox.cpp:501"; continued after pressing the enter key Win98: Holding the scan (for some days), crashed on canceling (at file test and at compressed files test) WinNT: Took over 250 hours to scan file viruses, one crash at macro test F/Win Win95: Crashed completely at macro test Inoculan: DOS: Two of 3 DOS-clients didnot have enough memory to scan at all; scan of compressed files failed on all 3 PCs (Error "not enough memory") Win95/98: Windows version was unable to write report; CMD-line-Version was unable to scan compres- sed files (Error "can't allocate memory to scan c.f.") Win95: Also crashed 3 times at packed files test WinNT: Given version was unable to run under WinNT IRIS: WinNT: Given version was unable to run under WinNT IVB: DOS: Could not write a report file McAfee Scan: DOS: Didnot scan compressed files (although switch ISC was set) Win95: Crashed twice at file virus test, once at malware test Win 95/98: Every start of a scan just after another scan hung the whole PC and required a new start. Win98/NT: Crashed on Virus "PS-MPC" Norman Virus Control: DOS: Recognized LZH-archives but was unable to unpack them Win95: Crashed completely at compressed file viruses Win95/98: Several crashes on macro viruses, leaving an empty report Win98: One crash at file viruses with error message "Der schwere Ausnahmefehler 0E ist an der Adresse 0028:C024075 in der VXD-Datei VMM(0E) +00001750 aufgetreten"(fatal exception error) WinNT: Some crashes at the same point, but scan of only that subdirectory produces no crash; crashed twice at packed macro and completely at macro virus test. Norton Antivirus: Win95: Crashed at file virus test Win98: Crashes at file and macro test completely (three times); one crash at packed macro test Perforin: Win95/98/NT: Loading signature update not possible; product was therefore released from test Romanian AV: DOS: Scanned all files only in DOS-Box of WinNT Win95/98: Several crashes (< 10) on certain files while scanning macro, packed macro, packed file and macro malware Sweep: DOS: Displayed archive but didnot perform scanning Tscan: DOS: Crashed (several attempts); tests performed in DOS-Box under Win-NT worked (see results) NT: Numerous I/O-Errors TNT: All systems: Cuts report files VDS: DOS: Macro scanner can only be run under Windows Win 95/98/NT: Given version refused to run, reporting that it is too old, but it contains parts as well of 1997 as 1998, so it also could not be run with the PC date set to 1997. Vet: Macro-test: after some scanning done, an error message "unable to scan file" appears Virusbuster: Win95: Crashed in file virus test disabling the network connections, leaving no report; crashed completely on macro, macro malware and packed macro tests Win98: Two crashes disabled network connections, a 3rd crash required a new start of the PC, leaving no report (file test) WinNT: The setup-file with the name "Win95NT" pro- duced the message: "This Setup is only for Windows 95 and Windows 98 !"