================================================ aVTC Test "2002-12" (File 6fW98.TXT): ------------------------------------------------ Detailed results of File, Macro and Script Virus related on-demand scanner tests under W-98: ================================================ (Formatted with non-proportional font: Courier) The following *18* products (versions) participated in this part of VTC test "2002-12" (for details of related AV products: see A2SCNLS.txt): ========================================================== AVA v(def): CLI Lguard32, version 3.0 Eng: 3.0.406.14 sig-date: Dec.13,2001 AVG v(def): 6.0.309 date: Dec.13,2001 sig: 170 sig-date: Dec.17,2001 AVK v(def): 10,1,0,0 sig: 10.0.435 sig-date: Dec.13,2001 AVP v(def): 3.55.160.0 date: Dec.12,2001 BDF v(def): v6.3.6 CMD v(def): 4.62.4 date: Aug.11,2001 Eng: 3.55.160.3203 Sig: Sign.def sig-date: Dec.17,2001 Sig: Sign2.def sig-date: Dec.17,2001 Sig: Macro.def sig-date: Dec.17,2001 DRW v(def): 4.26 (DrWeb32.txt) sig-date: Sept.25,2001 Sig: (drwtoday.vbd) sig-date: Dec.17,2001 FPR v(def): 3.11b Sig:(binary viruses)sig-date: Dec.17,2001 Sig:(macro viruses) sig-date: Dec.16,2001 FPW v(def)/sig: --- FSE v(def): 1.00.1251 Sig/date: December 14, 2001 Eng: 3.09.507 (F-PROT) Eng: 3.55.160.3210 (AVP) Eng: 1.02.15 (Orion) INO v(def): Eng: 49.00 date: Dec.14,2001 Sig: sig-date: Dec.17,2001 MR2 v(def): 1.20 sig-date: Dec.12,2001 NAV v(def): 7.60.926 Eng: 4.1.0.15 Sig: rev.3 sig-date: December 14,2001 NVC v(def): 5.00.36 Sig:(binary viruses) sig-date: Dec.17,2001 Sig:(macro viruses) sig-date: Dec.16,2001 PRO v(def): 7.1.C04 date: Dec.17,2001 sig-date: Dec.17,2001 RAV v(def): 8.3.1 command line for Win32 i386 Eng: 8.5 for i386 sig-date: Dec.17,2001 SCN v(def): 4.1.60 Sig: 4177 sig-date: Dec.17,2001 VSP v(def): 12.34.1 date: Dec.17,2001 sig-date: Dec.17,2001 =========================================================== The following tables summarize detection and identification quality concerning FILE, MACRO and SCRIPT viruses as well as selected FILE, MACRO and SCRIPT MALWARE, both in full "zoo" virus collection and for viral In-The-Wild testbeds, under Windows-98. Moreover, results for detection of viruses in objects compressed with 6 popular packing methods are also given. Finally, a special test was performed concerning "false positive" virus detection of selected files which were deliberately chosen from available CD-ROMs and which were definitively clean of viruses. For discussion of results, see 7EVALW98.txt. As usual, results may be influenced by problems experienced during tests; such problems are documented in 8PROBLMS.TXT. Index of tables: ---------------- W98.F1: "FileVirus 1": Results of "full" Zoo test for file viruses W98.F2: "FileVirus 2": Results of "In-The-Wild" test for file viruses W98.F3V: "Comparison of Detection Rate of Packed Viruses": Results of Detection Rate of ITW file viruses packed with PKZIP, LHA, ARJ, RAR, WinRAR 2.9 and CAB W98.F3F: "Comparison of Detection Rate of Packed Viral Objects": Results of Detection Rate of infected ITW file objects packed with PKZIP, LHA, ARJ, RAR, WinRAR 2.9 and CAB W98.F3a: "PKZIP-Packed File Viruses": Results of Detection of ITW File Viruses Packed with PKZIP W98.F3b: "LHA-Packed File Viruses": Results of Detection of ITW File Viruses Packed with LHA W98.F3c: "ARJ-Packed File Viruses": Results of Detection of ITW File Viruses Packed with ARJ W98.F3d: "RAR-Packed File Viruses": Results of Detection of ITW File Viruses Packed with RAR W98.F3e: "WINRAR-Packed Macro Viruses": Results of Detection of ITW File Viruses Packed with WINRAR 2.9 W98.F3f: "CAB-Packed File Viruses": Results of Detection of ITW File Viruses Packed with CAB W98.F4: "False Positive" File Virus Detection: Results of "full" Zoo test for non-viral (clean) file objects detected as "false positives" W98.F5: "File-Malware": Results of "full" Zoo test for file-related (non-viral) malware W98.M1: "MacroVirus 1": Results of "full" test for macro viruses W98.M2: "MacroVirus 2": Results of "In-The-Wild" test for macro viruses W98.M3V: "Comparison of Detection Rate of Packed Viruses": Results of Detection Rate of ITW file viruses packed with PKZIP, LHA, ARJ, RAR, WinRAR 2.0 and CAB W98.F3F: "Comparison of Detection Rate of Packed Viral Objects": Results of Detection Rate of objects infected with ITW file viruses and with PKZIP, LHA, ARJ, RAR, WinRAR 2.0, CAB W98.M3a: "PKZIP-Packed Macro Viruses": Results of Detection of ITW macro Viruses Packed with PKZIP W98.M3b: "LHA-Packed Macro Viruses": Results of Detection of ITW macro Viruses Packed with LHA W98.M3c: "ARJ-Packed Macro Viruses": Results of Detection of ITW macro Viruses Packed with ARJ W98.M3d: "RAR-Packed Macro Viruses": Results of Detection of ITW macro Viruses Packed with RAR W98.M3e: "WinRAR-Packed Macro Viruses": Results of Detection of ITW macro Viruses Packed with WinRAR 2.0 W98.M3f: "CAB-Packed Macro Viruses": Results of Detection of ITW macro Viruses Packed with CAB W98.M4: "False Positive" detection: Results of "full" zoo test for non-viral (clean) macro objects detected as "false positives" W98.M5: "Macro-Malware": Results of "full" zoo test for Macro-related malware W98.S1: "ScriptVirus 1": Results of "full" test for script viruses (VBS, JS etc) W98.S2: "ScriptVirus 2": Results of "In-The-Wild" test for script viruses W98.S5: "Script-Malware": Results of "full" zoo test for Script-related malware Table W98.F1: "FileVirus 1": Results of "full" Zoo Test for file viruses: ==================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ------------------------------------------------------------ Testbed 21790 100.0% 158747 100.0% ------------------------------------------------------------ AVA 20962 96.2 753 3.5 426 2.0 152468 96.0 AVG 17556 80.6 6086 27.9 459 2.1 133993 84.4 AVK 21777 99.9 837 3.8 10 0.~ 158679 100.~ AVP 21783 100.~ 623 2.9 1 0.~ 158701 100.~ BDF 18054 82.9 1444 6.6 797 3.7 135716 85.5 CMD 21458 98.5 169 0.8 73 0.3 157448 99.2 DRW 21414 98.3 1119 5.1 257 1.2 156767 98.8 FPR 21526 98.8 194 0.9 43 0.2 157777 99.4 FPW 21524 98.8 199 0.9 54 0.2 157725 99.4 FSE 21780 100.~ 203 0.9 4 0.~ 158690 100.~ INO 21514 98.7 786 3.6 208 1.0 157117 99.0 MR2 274 1.3 16 0.1 88 0.4 2514 1.6 NAV 2532 11.6 367 1.7 88 0.4 19747 12.4 NVC 21313 97.8 6143 28.2 275 1.3 155567 98.0 PRO 15144 69.5 769 3.5 1988 9.1 106412 67.0 RAV 21065 96.7 770 3.5 331 1.5 153343 96.6 SCN 21736 99.8 951 4.4 49 0.2 158425 99.8 VSP 1059 4.9 248 1.1 168 0.8 8601 5.4 ------------------------------------------------------------ Mean: 79.7% 80.1% Mean (rate>10%): 89.3% 89.7% ------------------------------------------------------------ Remark: decimal ~ indicates that result is rounded: (100.~ up to 100.0%, 0.~ down to 0.0%). Table W98.F2: "FileVirus 2": Results of "In-The-Wild" Test for file viruses: ==================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ------------------------------------------------------------ Testbed 50 100.0% 442 100.0% ------------------------------------------------------------ AVA 50 100.0 7 14.0 4 8.0 434 98.2 AVG 49 98.0 10 20.0 3 6.0 435 98.4 AVK 50 100.0 6 12.0 0 0.0 442 100.0 AVP 50 100.0 6 12.0 0 0.0 442 100.0 BDF 50 100.0 6 12.0 6 12.0 428 96.8 CMD 49 98.0 4 8.0 3 6.0 433 98.0 DRW 50 100.0 5 10.0 0 0.0 442 100.0 FPR 49 98.0 4 8.0 3 6.0 433 98.0 FPW 49 98.0 4 8.0 3 6.0 433 98.0 FSE 50 100.0 8 16.0 0 0.0 442 100.0 INO 50 100.0 7 14.0 1 2.0 441 99.8 MR2 12 24.0 0 0.0 4 8.0 169 38.2 NAV 50 100.0 11 22.0 0 0.0 442 100.0 NVC 50 100.0 6 12.0 6 12.0 430 97.3 PRO 50 100.0 2 4.0 11 22.0 404 91.4 RAV 50 100.0 7 14.0 2 4.0 438 99.1 SCN 50 100.0 4 8.0 0 0.0 442 100.0 VSP 5 10.0 1 2.0 1 2.0 120 27.1 ------------------------------------------------------------ Mean: 90.3% 91.1% Mean (rate>10%): 95.1% 94.9% ------------------------------------------------------------ Table W98.F3V: "Comparison of Detection Rate of Packed Viruses": Results of Detection Rate of ITW file viruses packed with PKZIP, LHA, ARJ, RAR, WinRAR, CAB ================================================================ This includes Viruses detected per packer ------------------------------------------------------------------------------ ARJ % CAB % LHA % RAR % WinRAR 2.9 % ZIP % ------------------------------------------------------------------------------ Testbed 50 100.0% 50 100.0% 50 100.0% 50 100.0% 50 100.0% 50 100.0% ------------------------------------------------------------------------------- AVA 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 AVG 49 98.0 0 0.0 0 0.0 49 98.0 0 0.0 49 98.0 AVK 50 100.0 50 100.0 50 100.0 50 100.0 0 0.0 50 100.0 AVP 50 100.0 50 100.0 50 100.0 50 100.0 0 0.0 50 100.0 BDF 50 100.0 50 100.0 50 100.0 50 100.0 0 0.0 50 100.0 CMD 49 98.0 49 98.0 49 98.0 49 98.0 0 0.0 49 98.0 DRW 50 100.0 50 100.0 0 0.0 50 100.0 0 0.0 50 100.0 FPR 49 98.0 49 98.0 49 98.0 49 98.0 0 0.0 49 98.0 FPW 49 98.0 49 98.0 49 98.0 49 98.0 0 0.0 49 98.0 FSE 35 70.0 0 0.0 35 70.0 0 0.0 0 0.0 35 70.0 INO 48 96.0 0 0.0 0 0.0 0 0.0 0 0.0 47 94.0 MR2 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 NAV 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 50 100.0 NVC 50 100.0 0 0.0 0 0.0 0 0.0 0 0.0 50 100.0 PRO 50 100.0 0 0.0 0 0.0 0 0.0 0 0.0 50 100.0 RAV 50 100.0 50 100.0 0 0.0 50 100.0 2 4.0 50 100.0 SCN 50 100.0 50 100.0 50 100.0 50 100.0 0 0.0 50 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 ------------------------------------------------------------------------------- Mean: 75.4% 49.7% 42.4% 55.1% 0.2% 80.9% Mean rate>10%:97.0% 99.3% 95.5% 99.2% --- 97.1% ------------------------------------------------------------------------------- Table W98.F3F: "Comparison of Detection Rate of Packed Viral Objects": Results of Detection Rate of objects infected with ITW file viruses and with PKZIP, LHA, ARJ, RAR, WinRAR, CAB ======================================================================== This includes Viral objects detected per packer ------------------------------------------------------------------------------- ARJ % CAB % LHA % RAR % WinRAR 2.9 % ZIP % ------------------------------------------------------------------------------- Testbed 442 100.0% 442 100.0% 442 100.0% 442 100.0% 442 100.0% 442 100.0% ------------------------------------------------------------------------------- AVA 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 AVG 435 98.4 0 0.0 0 0.0 435 98.4 0 0.0 424 95.9 AVK 442 100.0 442 100.0 442 100.0 442 100.0 0 0.0 442 100.0 AVP 442 100.0 442 100.0 442 100.0 442 100.0 0 0.0 442 100.0 BDF 428 96.8 428 96.8 428 96.8 428 96.8 0 0.0 428 96.8 CMD 433 98.0 433 98.0 433 98.0 433 98.0 0 0.0 433 98.0 DRW 442 100.0 442 100.0 0 0.0 442 100.0 0 0.0 442 100.0 FPR 433 98.0 433 98.0 433 98.0 433 98.0 0 0.0 433 98.0 FPW 433 98.0 433 98.0 433 98.0 433 98.0 0 0.0 433 98.0 FSE 383 86.7 0 0.0 383 86.7 0 0.0 0 0.0 383 86.7 INO 433 98.0 0 0.0 0 0.0 0 0.0 0 0.0 431 97.5 MR2 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 NAV 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 442 100.0 NVC 430 97.3 0 0.0 0 0.0 0 0.0 0 0.0 430 97.3 PRO 404 91.4 0 0.0 0 0.0 0 0.0 0 0.0 404 91.4 RAV 438 99.1 438 99.1 0 0.0 438 99.1 9 2.0 438 99.1 SCN 442 100.0 442 100.0 442 100.0 442 100.0 0 0.0 442 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 ------------------------------------------------------------------------------- Mean: 75.7% 49.4% 43.3% 54.9% 0.1% 81.0% Mean rate>10%:97.3% 98.8% 97.2% 98.8% --- 97.3% ------------------------------------------------------------------------------- Table W98.F3a: "PKZIP-Packed File Viruses": Results of Detection of ITW File Viruses Packed with PKZIP: ================================================================= This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 50 100.0% 443 100.0% ------------------------------------------------------------ AVA 0 0.0 0 0.0 0 0.0 0 0.0 AVG 49 98.0 7 14.0 11 22.0 424 95.9 AVK 50 100.0 6 12.0 0 0.0 442 100.0 AVP 50 100.0 6 12.0 0 0.0 442 100.0 BDF 50 100.0 6 12.0 6 12.0 428 96.8 CMD 49 98.0 4 8.0 3 6.0 433 98.0 DRW 50 100.0 5 10.0 0 0.0 442 100.0 FPR 49 98.0 4 8.0 3 6.0 433 98.0 FPW 49 98.0 4 8.0 3 6.0 433 98.0 FSE 35 70.0 0 0.0 35 70.0 383 86.7 INO 47 94.0 4 8.0 2 4.0 431 97.5 MR2 0 0.0 0 0.0 0 0.0 0 0.0 NAV 50 100.0 11 22.0 0 0.0 442 100.0 NVC 50 100.0 6 12.0 6 12.0 430 97.3 PRO 50 100.0 2 4.0 11 22.0 404 91.4 RAV 50 100.0 7 14.0 2 4.0 438 99.1 SCN 50 100.0 4 8.0 0 0.0 442 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 ----------------------------------------------------------- Mean: 80.9% 81.0% Mean (rate>10%): 97.1% 97.3% ----------------------------------------------------------- Table W98.F3b: "LHA-Packed File Viruses": Results of Detection of ITW File Viruses Packed with LHA: =============================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 50 100.0% 443 100.0% ------------------------------------------------------------ AVA 0 0.0 0 0.0 0 0.0 0 0.0 AVG 0 0.0 0 0.0 0 0.0 0 0.0 AVK 50 100.0 6 12.0 0 0.0 442 100.0 AVP 50 100.0 6 12.0 0 0.0 442 100.0 BDF 50 100.0 6 12.0 6 12.0 428 96.8 CMD 49 98.0 5 10.0 3 6.0 433 98.0 DRW 0 0.0 0 0.0 0 0.0 0 0.0 FPR 49 98.0 5 10.0 3 6.0 433 98.0 FPW 49 98.0 5 10.0 3 6.0 433 98.0 FSE 35 70.0 0 0.0 35 70.0 383 86.7 INO 0 0.0 0 0.0 0 0.0 0 0.0 MR2 0 0.0 0 0.0 0 0.0 0 0.0 NAV 0 0.0 0 0.0 0 0.0 0 0.0 NVC 0 0.0 0 0.0 0 0.0 0 0.0 PRO 0 0.0 0 0.0 0 0.0 0 0.0 RAV 0 0.0 0 0.0 0 0.0 0 0.0 SCN 50 100.0 4 8.0 0 0.0 442 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 ------------------------------------------------------------ Mean: 42.4% 43.3% Mean (rate>10%): 95.5% 97.2% ------------------------------------------------------------ Table W98.F3c: "ARJ-Packed File Viruses": Results of Detection of ITW File Viruses Packed with ARJ: =============================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 50 100.0% 443 100.0% ------------------------------------------------------------ AVA 0 0.0 0 0.0 0 0.0 0 0.0 AVG 49 98.0 10 20.0 3 6.0 435 98.4 AVK 50 100.0 6 12.0 0 0.0 442 100.0 AVP 50 100.0 6 12.0 0 0.0 442 100.0 BDF 50 100.0 6 12.0 6 12.0 428 96.8 CMD 49 98.0 4 8.0 3 6.0 433 98.0 DRW 50 100.0 5 10.0 0 0.0 442 100.0 FPR 49 98.0 4 8.0 3 6.0 433 98.0 FPW 49 98.0 4 8.0 3 6.0 433 98.0 FSE 35 70.0 0 0.0 35 70.0 383 86.7 INO 48 96.0 4 8.0 2 4.0 433 98.0 MR2 0 0.0 0 0.0 0 0.0 0 0.0 NAV 0 0.0 0 0.0 0 0.0 0 0.0 NVC 50 100.0 6 12.0 6 12.0 430 97.3 PRO 50 100.0 2 4.0 11 22.0 404 91.4 RAV 50 100.0 7 14.0 2 4.0 438 99.1 SCN 50 100.0 4 8.0 0 0.0 442 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 ----------------------------------------------------------- Mean: 75.4% 75.7% Mean (rate>10%): 97.0% 97.3% ----------------------------------------------------------- Table W98.F3d: "RAR-Packed File Viruses": Results of Detection of ITW File Viruses Packed with RAR: =============================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 50 100.0% 443 100.0% ------------------------------------------------------------ AVA 0 0.0 0 0.0 0 0.0 0 0.0 AVG 49 98.0 10 20.0 3 6.0 435 98.4 AVK 50 100.0 6 12.0 0 0.0 442 100.0 AVP 50 100.0 6 12.0 0 0.0 442 100.0 BDF 50 100.0 6 12.0 6 12.0 428 96.8 CMD 49 98.0 4 8.0 3 6.0 433 98.0 DRW 50 100.0 5 10.0 0 0.0 442 100.0 FPR 49 98.0 4 8.0 3 6.0 433 98.0 FPW 49 98.0 4 8.0 3 6.0 433 98.0 FSE 0 0.0 0 0.0 0 0.0 0 0.0 INO 0 0.0 0 0.0 0 0.0 0 0.0 MR2 0 0.0 0 0.0 0 0.0 0 0.0 NAV 0 0.0 0 0.0 0 0.0 0 0.0 NVC 0 0.0 0 0.0 0 0.0 0 0.0 PRO 0 0.0 0 0.0 0 0.0 0 0.0 RAV 50 100.0 7 14.0 2 4.0 438 99.1 SCN 50 100.0 4 8.0 0 0.0 442 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 ----------------------------------------------------------- Mean: 55.1% 54.9% Mean (rate>10%): 99.2% 98.8% ----------------------------------------------------------- Table W98.F3e: "WINRAR-Packed File Viruses": Results of Detection of ITW File Viruses Packed with WINRAR 2.9: ================================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 50 100.0% 443 100.0% ------------------------------------------------------------ AVA 0 0.0 0 0.0 0 0.0 0 0.0 AVG 0 0.0 0 0.0 0 0.0 0 0.0 AVK 0 0.0 0 0.0 0 0.0 0 0.0 AVP 0 0.0 0 0.0 0 0.0 0 0.0 BDF 0 0.0 0 0.0 0 0.0 0 0.0 CMD 0 0.0 0 0.0 0 0.0 0 0.0 DRW 0 0.0 0 0.0 0 0.0 0 0.0 FPR 0 0.0 0 0.0 0 0.0 0 0.0 FPW 0 0.0 0 0.0 0 0.0 0 0.0 FSE 0 0.0 0 0.0 0 0.0 0 0.0 INO 0 0.0 0 0.0 0 0.0 0 0.0 MR2 0 0.0 0 0.0 0 0.0 0 0.0 NAV 0 0.0 0 0.0 0 0.0 0 0.0 NVC 0 0.0 0 0.0 0 0.0 0 0.0 PRO 0 0.0 0 0.0 0 0.0 0 0.0 RAV 2 4.0 0 0.0 2 4.0 9 2.0 SCN 0 0.0 0 0.0 0 0.0 0 0.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 ----------------------------------------------------------- Mean: 0.2% 0.1% Mean (rate>10%): --- --- ----------------------------------------------------------- Table W98.F3f: "CAB-Packed File Viruses": Results of Detection of ITW File Viruses Packed with CAB: =============================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 50 100.0% 443 100.0% ------------------------------------------------------------ AVA 0 0.0 0 0.0 0 0.0 0 0.0 AVG 0 0.0 0 0.0 0 0.0 0 0.0 AVK 50 100.0 6 12.0 0 0.0 442 100.0 AVP 50 100.0 6 12.0 0 0.0 442 100.0 BDF 50 100.0 6 12.0 6 12.0 428 96.8 CMD 49 98.0 4 8.0 3 6.0 433 98.0 DRW 50 100.0 5 10.0 0 0.0 442 100.0 FPR 49 98.0 4 8.0 3 6.0 433 98.0 FPW 49 98.0 4 8.0 3 6.0 433 98.0 FSE 0 0.0 0 0.0 0 0.0 0 0.0 INO 0 0.0 0 0.0 0 0.0 0 0.0 MR2 0 0.0 0 0.0 0 0.0 0 0.0 NAV 0 0.0 0 0.0 0 0.0 0 0.0 NVC 0 0.0 0 0.0 0 0.0 0 0.0 PRO 0 0.0 0 0.0 0 0.0 0 0.0 RAV 50 100.0 7 14.0 2 4.0 438 99.1 SCN 50 100.0 4 8.0 0 0.0 442 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 ----------------------------------------------------------- Mean: 49.7% 49.4% Mean (rate>10%): 99.3% 98.9% ----------------------------------------------------------- Table W98.F4: "False Positive" file virus detection: Results of "full" Zoo test for non-viral (clean) file objects detected as "false positives": ============================================================= False positive Scanner detection ----------------------------- Testbed 664 100.0% ----------------------------- AVA 0 0.0 AVG 0 0.0 AVK 0 0.0 AVP 0 0.0 BDF 0 0.0 CMD 0 0.0 DRW 1 0.2 FPR 0 0.0 FPW 0 0.0 FSE 0 0.0 INO 0 0.0 MR2 0 0.0 NAV 0 0.0 NVC 0 0.0 PRO 0 0.0 RAV 0 0.0 SCN 0 0.0 VSP 0 0.0 ----------------------------- Table W98.F5: "File-Malware": Results of "full" Zoo Test for File-related malware: ==================================================== This includes Malware ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 8001 100.0% 18277 100.0% ------------------------------------------------------------ AVA 5920 74.0 1718 21.5 480 6.0 13654 74.7 AVG 4025 50.3 1173 14.7 416 5.2 8242 45.1 AVK 7893 98.7 822 10.3 47 0.6 18076 98.9 AVP 7899 98.7 778 9.7 40 0.5 18098 99.0 BDF 4570 57.1 305 3.8 537 6.7 9903 54.2 CMD 7283 91.0 3366 42.1 287 3.6 16184 88.5 DRW 6028 75.3 466 5.8 389 4.9 13424 73.4 FPR 7306 91.3 3383 42.3 289 3.6 16290 89.1 FPW 7306 91.3 3387 42.3 286 3.6 16287 89.1 FSE 7929 99.1 3549 44.4 32 0.4 18139 99.2 INO 6643 83.0 2117 26.5 589 7.4 14132 77.3 MR2 2400 30.0 91 1.1 374 4.7 3791 20.7 NAV 6238 78.0 1354 16.9 574 7.2 13254 72.5 NVC 6247 78.1 1601 20.0 402 5.0 14439 79.0 PRO 2948 36.8 87 1.1 514 6.4 5200 28.5 RAV 6889 86.1 411 5.1 403 5.0 15026 82.2 SCN 7422 92.8 660 8.2 82 1.0 17457 95.5 VSP 3066 38.3 547 6.8 213 2.7 4852 26.5 ----------------------------------------------------------- Mean: 75.0% 71.9% Mean (rate>10%): 75.0% 71.9% ----------------------------------------------------------- Table W98.M1: "MacroVirus 1": Results of "full" zoo test for macro viruses under Windows 98: ======================================================= This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 7306 100.0% 25231 100.0% ------------------------------------------------------------ AVA 7147 97.8 48 0.7 39 0.5 24703 97.9 AVG 7167 98.1 59 0.8 15 0.2 24772 98.2 AVK 7304 100.~ 163 2.2 1 0.~ 25193 99.8 AVP 7304 100.~ 134 1.8 1 0.~ 25193 99.8 BDF 7231 99.0 1727 23.6 12 0.2 24942 98.9 CMD 7302 99.9 62 0.8 4 0.1 25199 99.9 DRW 7263 99.4 172 2.4 15 0.2 25110 99.5 FPR 7303 100.~ 63 0.9 4 0.1 25200 99.9 FPW 7303 100.~ 63 0.9 4 0.1 25200 99.9 FSE 7305 100.~ 57 0.8 0 0.0 25222 100.~ INO 7298 99.9 130 1.8 6 0.1 25204 99.9 MR2 2769 37.9 834 11.4 78 1.1 8117 32.2 NAV 7290 99.8 259 3.5 12 0.2 25152 99.7 NVC 7295 99.8 118 1.6 16 0.2 25161 99.7 PRO 5315 72.7 190 2.6 189 2.6 17535 69.5 RAV 7299 99.9 423 5.8 7 0.1 25211 99.9 SCN 7306 100.0 80 1.1 1 0.~ 25227 100.~ VSP 2 0.~ 0 0.0 2 0.~ 2 0.~ ----------------------------------------------------------- Mean 89.1% 88.6% Mean (rate>10%) 94.4% 93.8% ----------------------------------------------------------- Remark: decimal ~ indicates that result is rounded: (100.~ up to 100.0%, 0.~ down to 0.0%). Table W98.M2: "MacroVirus 2": Results of "In-The-Wild" test for macro viruses under Windows 98: ======================================================= This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 124 100.0% 1337 100.0% ------------------------------------------------------------ AVA 124 100.0 7 5.6 4 3.2 1332 99.6 AVG 124 100.0 12 9.7 1 0.8 1336 99.9 AVK 124 100.0 11 8.9 0 0.0 1337 100.0 AVP 124 100.0 10 8.1 0 0.0 1337 100.0 BDF 124 100.0 18 14.5 1 0.8 1336 99.9 CMD 124 100.0 6 4.8 1 0.8 1336 99.9 DRW 124 100.0 11 8.9 0 0.0 1337 100.0 FPR 124 100.0 5 4.0 1 0.8 1336 99.9 FPW 124 100.0 6 4.8 1 0.8 1336 99.9 FSE 124 100.0 6 4.8 0 0.0 1337 100.0 INO 124 100.0 9 7.3 0 0.0 1337 100.0 MR2 11 8.9 1 0.8 4 3.2 374 28.0 NAV 124 100.0 12 9.7 0 0.0 1337 100.0 NVC 124 100.0 13 10.5 2 1.6 1335 99.9 PRO 124 100.0 19 15.3 7 5.6 1327 99.3 RAV 124 100.0 27 21.8 2 1.6 1334 99.8 SCN 124 100.0 8 6.5 0 0.0 1337 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 ----------------------------------------------------------- Mean 89.4% 90.3% Mean rate>10% 100.0% 99.9% ----------------------------------------------------------- Table W98.M3V: "Comparison of Detection Rate of Packed Viruses": Results of Detection Rate of ITW macro viruses packed with PKZIP, LHA, ARJ, RAR, WinRAR and CAB ================================================================ This includes Viruses detected per packer ------------------------------------------------------------------------------ ARJ % CAB % LHA % RAR % WinRAR 2.0 % ZIP % ------------------------------------------------------------------------------ Testbed 124 100.0% 124 100.0% 124 100.0% 124 100.0% 124 100.0% 124 100.0% ------------------------------------------------------------------------------- AVA 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 AVG 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 AVK 124 100.0 124 100.0 124 100.0 124 100.0 124 100.0 124 100.0 AVP 124 100.0 124 100.0 124 100.0 124 100.0 124 100.0 124 100.0 BDF 124 100.0 124 100.0 124 100.0 124 100.0 124 100.0 124 100.0 CMD 124 100.0 124 100.0 124 100.0 124 100.0 124 100.0 124 100.0 DRW 124 100.0 124 100.0 0 0.0 124 100.0 124 100.0 124 100.0 FPR 124 100.0 124 100.0 124 100.0 124 100.0 124 100.0 124 100.0 FPW 124 100.0 124 100.0 124 100.0 124 100.0 124 100.0 124 100.0 FSE 124 100.0 0 0.0 124 100.0 0 0.0 0 0.0 124 100.0 INO 124 100.0 0 0.0 0 0.0 0 0.0 0 0.0 124 100.0 MR2 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 NAV 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 124 100.0 NVC 124 100.0 0 0.0 0 0.0 0 0.0 0 0.0 124 100.0 PRO 124 100.0 0 0.0 0 0.0 0 0.0 0 0.0 124 100.0 RAV 97 78.2 97 78.2 0 0.0 97 78.2 97 78.2 96 77.4 SCN 124 100.0 124 100.0 124 100.0 124 100.0 124 100.0 124 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 ------------------------------------------------------------------------------ Mean 76.6% 48.8% 44.4% 54.3% 54.3% 82.1% Meanrate>10% 98.4% 97.6% 100.0% 97.8% 97.8% 98.5% ------------------------------------------------------------------------------ Table W98.M3F: "Comparison of Detection Rate of Packed Viral Objects": Results of Detection Rate of objects infected with ITW macro viruses and with PKZIP, LHA, ARJ, RAR, WinRAR, CAB ======================================================================= This includes Viral objects detected per packer ------------------------------------------------------------------------------ ARJ % CAB % LHA % RAR % WinRAR 2.0 % ZIP % ------------------------------------------------------------------------------ Testbed 1337 100.0% 1337 100.0% 1337 100.0% 1337 100.0% 1337 100.0% 1337 100.0% ------------------------------------------------------------------------------- AVA 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 AVG 1336 99.9 0 0.0 0 0.0 1336 99.9 1336 99.9 1324 99.0 AVK 1337 100.0 1336 99.9 1337 100.0 1337 100.0 1337 100.0 1337 100.0 AVP 1337 100.0 1336 99.9 1337 100.0 1337 100.0 1337 100.0 1337 100.0 BDF 1336 99.9 1336 99.9 1336 99.9 1336 99.9 1336 99.9 1336 99.9 CMD 1336 99.9 1336 99.9 1336 99.9 1336 99.9 1336 99.9 1336 99.9 DRW 1337 100.0 1337 100.0 0 0.0 1337 100.0 1337 100.0 1337 100.0 FPR 1336 99.9 1336 99.9 1336 99.9 1336 99.9 1336 99.9 1336 99.9 FPW 1336 99.9 1336 99.9 1336 99.9 1336 99.9 1336 99.9 1336 99.9 FSE 1212 90.7 0 0.0 1212 90.7 0 0.0 0 0.0 1212 90.7 INO 1337 100.0 0 0.0 0 0.0 0 0.0 0 0.0 1337 100.0 MR2 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 NAV 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 1337 100.0 NVC 1335 99.9 0 0.0 0 0.0 0 0.0 0 0.0 1335 99.9 PRO 1327 99.3 0 0.0 0 0.0 0 0.0 0 0.0 1327 99.3 RAV 1078 80.6 1078 80.6 0 0.0 1078 80.6 964 72.1 850 63.6 SCN 1337 100.0 1337 100.0 1337 100.0 1337 100.0 1337 100.0 1337 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 0 0.0 ------------------------------------------------------------------------------- Mean 46.1% 48.9% 43.9% 54.5% 54.0% 80.7% Meanrate>10% 87.9% 97.8% 98.8% 98.0% 97.2% 96.8% ------------------------------------------------------------------------------- Table W98.M3a: "PKZIP-Packed Macro Viruses": Results of Detection of ITW Macro Viruses Packed with PKZIP under Windows 98: ===================================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 124 100.0% 1337 100.0% ------------------------------------------------------------ AVA 0 0.0 0 0.0 0 0.0 0 0.0 AVG 124 100.0 11 8.9 10 8.1 1324 99.0 AVK 124 100.0 12 9.7 0 0.0 1337 100.0 AVP 124 100.0 10 8.1 0 0.0 1337 100.0 BDF 124 100.0 18 14.5 1 0.8 1336 99.9 CMD 124 100.0 6 4.8 1 0.8 1336 99.9 DRW 124 100.0 12 9.7 0 0.0 1337 100.0 FPR 124 100.0 6 4.8 1 0.8 1336 99.9 FPW 124 100.0 6 4.8 1 0.8 1336 99.9 FSE 124 100.0 0 0.0 124 100.0 1212 90.7 INO 124 100.0 9 7.3 0 0.0 1337 100.0 MR2 0 0.0 0 0.0 0 0.0 0 0.0 NAV 124 100.0 12 9.7 0 0.0 1337 100.0 NVC 124 100.0 13 10.5 2 1.6 1335 99.9 PRO 124 100.0 19 15.3 7 5.6 1327 99.3 RAV 96 77.4 26 21.0 2 1.6 850 63.6 SCN 124 100.0 8 6.5 0 0.0 1337 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 ----------------------------------------------------------- Mean 82.1% 80.7% Mean rate>10% 98.5% 96.8% ------------------------------------------------------------ Table W98.M3b: "LHA-Packed Macro Viruses": Results of Detection of ITW Macro Viruses Packed with LHA under Windows 98: ================================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 124 100.0% 1337 100.0% ------------------------------------------------------------ AVA 0 0.0 0 0.0 0 0.0 0 0.0 AVG 0 0.0 0 0.0 0 0.0 0 0.0 AVK 124 100.0 12 9.7 0 0.0 1337 100.0 AVP 124 100.0 10 8.1 0 0.0 1337 100.0 BDF 124 100.0 18 14.5 1 0.8 1336 99.9 CMD 124 100.0 6 4.8 1 0.8 1336 99.9 DRW 0 0.0 0 0.0 0 0.0 0 0.0 FPR 124 100.0 6 4.8 1 0.8 1336 99.9 FPW 124 100.0 6 4.8 1 0.8 1336 99.9 FSE 124 100.0 0 0.0 124 100.0 1212 90.7 INO 0 0.0 0 0.0 0 0.0 0 0.0 MR2 0 0.0 0 0.0 0 0.0 0 0.0 NAV 0 0.0 0 0.0 0 0.0 0 0.0 NVC 0 0.0 0 0.0 0 0.0 0 0.0 PRO 0 0.0 0 0.0 0 0.0 0 0.0 RAV 0 0.0 0 0.0 0 0.0 0 0.0 SCN 124 100.0 8 6.5 0 0.0 1337 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 ----------------------------------------------------------- Mean 44.4% 43.9% Mean (rate>10%) 100.0% 98.8% ------------------------------------------------------------ Table W98.M3c: "ARJ-Packed Macro Viruses": Results of Detection of ITW Macro Viruses Packed with ARJ under Windows 98: ================================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 124 100.0% 1337 100.0% ------------------------------------------------------------ AVA 0 0.0 0 0.0 0 0.0 0 0.0 AVG 124 100.0 12 9.7 1 0.8 1336 99.9 AVK 124 100.0 12 9.7 0 0.0 1337 100.0 AVP 124 100.0 10 8.1 0 0.0 1337 100.0 BDF 124 100.0 18 14.5 1 0.8 1336 99.9 CMD 124 100.0 6 4.8 1 0.8 1336 99.9 DRW 124 100.0 12 9.7 0 0.0 1337 100.0 FPR 124 100.0 6 4.8 1 0.8 1336 99.9 FPW 124 100.0 6 4.8 1 0.8 1336 99.9 FSE 124 100.0 0 0.0 124 100.0 1212 90.7 INO 124 100.0 9 7.3 0 0.0 1337 100.0 MR2 0 0.0 0 0.0 0 0.0 0 0.0 NAV 0 0.0 0 0.0 0 0.0 0 0.0 NVC 124 100.0 13 10.5 2 1.6 1335 99.9 PRO 124 100.0 19 15.3 7 5.6 1327 99.3 RAV 97 78.2 27 21.8 2 1.6 1078 80.6 SCN 124 100.0 8 6.5 0 0.0 1337 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 ----------------------------------------------------------- Mean 76.6% 76.1% Mean (rate>10%) 98.4% 97.9% ------------------------------------------------------------ Table W98.M3d: "RAR-Packed Macro Viruses": Results of Detection of ITW Macro Viruses Packed with RAR under Windows 98: ================================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 124 100.0% 1337 100.0% ------------------------------------------------------------ AVA 0 0.0 0 0.0 0 0.0 0 0.0 AVG 124 100.0 12 9.7 1 0.8 1336 99.9 AVK 124 100.0 12 9.7 0 0.0 1337 100.0 AVP 124 100.0 10 8.1 0 0.0 1337 100.0 BDF 124 100.0 18 14.5 1 0.8 1336 99.9 CMD 124 100.0 6 4.8 1 0.8 1336 99.9 DRW 124 100.0 12 9.7 0 0.0 1337 100.0 FPR 124 100.0 6 4.8 1 0.8 1336 99.9 FPW 124 100.0 6 4.8 1 0.8 1336 99.9 FSE 0 0.0 0 0.0 0 0.0 0 0.0 INO 0 0.0 0 0.0 0 0.0 0 0.0 MR2 0 0.0 0 0.0 0 0.0 0 0.0 NAV 0 0.0 0 0.0 0 0.0 0 0.0 NVC 0 0.0 0 0.0 0 0.0 0 0.0 PRO 0 0.0 0 0.0 0 0.0 0 0.0 RAV 97 78.2 27 21.8 2 1.6 1078 80.6 SCN 124 100.0 8 6.5 0 0.0 1337 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 ----------------------------------------------------------- Mean 54.3% 54.5% Mean (rate>10%) 97.8% 98.0% ------------------------------------------------------------ Table W98.M3e: "WinRAR-Packed Macro Viruses": Results of Detection of ITW Macro Viruses Packed with WinRAR 2.0: ================================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 124 100.0% 1337 100.0% ------------------------------------------------------------ AVA 0 0.0 0 0.0 0 0.0 0 0.0 AVG 124 100.0 12 9.7 1 0.8 1336 99.9 AVK 124 100.0 12 9.7 0 0.0 1337 100.0 AVP 124 100.0 10 8.1 0 0.0 1337 100.0 BDF 124 100.0 18 14.5 1 0.8 1336 99.9 CMD 124 100.0 6 4.8 1 0.8 1336 99.9 DRW 124 100.0 12 9.7 0 0.0 1337 100.0 FPR 124 100.0 6 4.8 1 0.8 1336 99.9 FPW 124 100.0 6 4.8 1 0.8 1336 99.9 FSE 0 0.0 0 0.0 0 0.0 0 0.0 INO 0 0.0 0 0.0 0 0.0 0 0.0 MR2 0 0.0 0 0.0 0 0.0 0 0.0 NAV 0 0.0 0 0.0 0 0.0 0 0.0 NVC 0 0.0 0 0.0 0 0.0 0 0.0 PRO 0 0.0 0 0.0 0 0.0 0 0.0 RAV 97 78.2 26 21.0 3 2.4 964 72.1 SCN 124 100.0 8 6.5 0 0.0 1337 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 ----------------------------------------------------------- Mean 54.3% 54.0% Mean (rate>10%) 97.8% 97.2% ------------------------------------------------------------ Table W98.M3f: "CAB-Packed Macro Viruses": Results of Detection of ITW Macro Viruses Packed with CAB: =============================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 124 100.0% 1337 100.0% ------------------------------------------------------------ AVA 0 0.0 0 0.0 0 0.0 0 0.0 AVG 0 0.0 0 0.0 0 0.0 0 0.0 AVK 124 100.0 12 9.7 1 0.8 1336 99.9 AVP 124 100.0 10 8.1 1 0.8 1336 99.9 BDF 124 100.0 18 14.5 1 0.8 1336 99.9 CMD 124 100.0 6 4.8 1 0.8 1336 99.9 DRW 124 100.0 12 9.7 0 0.0 1337 100.0 FPR 124 100.0 6 4.8 1 0.8 1336 99.9 FPW 124 100.0 6 4.8 1 0.8 1336 99.9 FSE 0 0.0 0 0.0 0 0.0 0 0.0 INO 0 0.0 0 0.0 0 0.0 0 0.0 MR2 0 0.0 0 0.0 0 0.0 0 0.0 NAV 0 0.0 0 0.0 0 0.0 0 0.0 NVC 0 0.0 0 0.0 0 0.0 0 0.0 PRO 0 0.0 0 0.0 0 0.0 0 0.0 RAV 97 78.2 27 21.8 2 1.6 1078 80.6 SCN 124 100.0 8 6.5 0 0.0 1337 100.0 VSP 0 0.0 0 0.0 0 0.0 0 0.0 ----------------------------------------------------------- Mean 48.8% 48.9% Mean (rate>10%) 97.6% 97.8% ----------------------------------------------------------- Table W98.M4: "False Positive" macro virus detection: Results of "full" zoo test for non-viral (clean) macro objects detected as "false positives" under Windows 98: ================================================================= False positive Scanner detection ----------------------------- Testbed 329 100.0% ----------------------------- AVA 0 0.0 AVG 0 0.0 AVK 1 0.3 AVP 5 1.5 BDF 0 0.0 CMD 2 0.6 DRW 29 8.8 FPR 2 0.6 FPW 2 0.6 FSE 2 0.6 INO 0 0.0 MR2 20 6.1 NAV 0 0.0 NVC 5 1.5 PRO 0 0.0 RAV 1 0.3 SCN 0 0.0 VSP 0 0.0 ----------------------------- Mean 1.2% ----------------------------- Table W98.M5: "Macro-Malware": Results of "full" test for Macro-related malware under Windows 98: ========================================================= Macro This includes Malware ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 450 100.0% 747 100.0% ------------------------------------------------------------ AVA 408 90.7 4 0.9 7 1.6 646 86.5 AVG 361 80.2 1 0.2 5 1.1 621 83.1 AVK 450 100.0 3 0.7 1 0.2 745 99.7 AVP 450 100.0 1 0.2 1 0.2 745 99.7 BDF 413 91.8 100 22.2 5 1.1 679 90.9 CMD 447 99.3 2 0.4 0 0.0 735 98.4 DRW 410 91.1 30 6.7 8 1.8 683 91.4 FPR 447 99.3 2 0.4 0 0.0 735 98.4 FPW 447 99.3 2 0.4 0 0.0 735 98.4 FSE 450 100.0 3 0.7 1 0.2 745 99.7 INO 422 93.8 17 3.8 1 0.2 709 94.9 MR2 133 29.6 18 4.0 2 0.4 205 27.4 NAV 419 93.1 39 8.7 8 1.8 681 91.2 NVC 442 98.2 13 2.9 3 0.7 710 95.0 PRO 251 55.8 2 0.4 10 2.2 391 52.3 RAV 447 99.3 38 8.4 5 1.1 729 97.6 SCN 450 100.0 5 1.1 2 0.4 745 99.7 VSP 1 0.2 0 0.0 0 0.0 1 0.1 ----------------------------------------------------------- Mean 84.5% 83.6% Mean (rate>10%) 89.5% 88.5% ----------------------------------------------------------- Table W98.S1: "ScriptVirus 1": Results of "full" Zoo test for script viruses: ================================================= This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 823 100.0% 1574 100.0% ------------------------------------------------------------ AVA 259 31.5 7 0.9 47 5.7 565 35.9 AVG 526 63.9 32 3.9 46 5.6 1014 64.4 AVK 815 99.0 188 22.8 2 0.2 1563 99.3 AVP 814 98.9 83 10.1 1 0.1 1562 99.2 BDF 596 72.4 90 10.9 59 7.2 1074 68.2 CMD 733 89.1 112 13.6 25 3.0 1342 85.3 DRW 779 94.7 120 14.6 22 2.7 1436 91.2 FPR 730 88.7 108 13.1 28 3.4 1335 84.8 FPW 730 88.7 107 13.0 28 3.4 1333 84.7 FSE 819 99.5 139 16.9 2 0.2 1568 99.6 INO 779 94.7 114 13.9 31 3.8 1457 92.6 MR2 667 81.0 109 13.2 71 8.6 1146 72.8 NAV 798 97.0 246 29.9 27 3.3 1497 95.1 NVC 721 87.6 79 9.6 35 4.3 1270 80.7 PRO 492 59.8 75 9.1 67 8.1 873 55.5 RAV 791 96.1 108 13.1 26 3.2 1496 95.0 SCN 820 99.6 72 8.7 1 0.1 1570 99.7 VSP 668 81.2 96 11.7 72 8.7 1148 72.9 ----------------------------------------------------------- Mean 84.6% 82.1% Mean (rate>10%) 84.6% 82.1% ----------------------------------------------------------- Table W98.S2: "ScriptVirus 2": Results of "In-The-Wild" test for script viruses: ======================================================= This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 20 100.0% 122 100.0% ------------------------------------------------------------ AVA 20 100.0 0 0.0 3 15.0 114 93.4 AVG 20 100.0 3 15.0 0 0.0 122 100.0 AVK 20 100.0 5 25.0 0 0.0 122 100.0 AVP 20 100.0 3 15.0 0 0.0 122 100.0 BDF 20 100.0 3 15.0 1 5.0 119 97.5 CMD 20 100.0 4 20.0 0 0.0 122 100.0 DRW 20 100.0 2 10.0 0 0.0 122 100.0 FPR 20 100.0 4 20.0 0 0.0 122 100.0 FPW 20 100.0 4 20.0 0 0.0 122 100.0 FSE 20 100.0 4 20.0 0 0.0 122 100.0 INO 20 100.0 5 25.0 1 5.0 121 99.2 MR2 18 90.0 4 20.0 4 20.0 99 81.1 NAV 20 100.0 6 30.0 0 0.0 122 100.0 NVC 20 100.0 9 45.0 0 0.0 122 100.0 PRO 20 100.0 5 25.0 3 15.0 118 96.7 RAV 20 100.0 7 35.0 0 0.0 122 100.0 SCN 20 100.0 3 15.0 0 0.0 122 100.0 VSP 18 90.0 4 20.0 4 20.0 99 81.1 ----------------------------------------------------------- Mean 98.9% 97.2% Mean (rate>10%) 98.9% 97.2% ----------------------------------------------------------- Table W98.S5: "Script-Malware": Results of "full" test for Script-related malware under Windows 98: ========================================================= Macro This includes Malware ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 117 100.0% 202 100.0% ----------------------------------------------------------- AVA 2 1.7 0 0.0 0 0.0 2 1.0 AVG 14 12.0 0 0.0 1 0.9 15 7.4 AVK 112 95.7 19 16.2 3 2.6 189 93.6 AVP 112 95.7 18 15.4 3 2.6 189 93.6 BDF 38 32.5 8 6.8 10 8.5 43 21.3 CMD 33 28.2 16 13.7 6 5.1 36 17.8 DRW 72 61.5 14 12.0 10 8.5 120 59.4 FPR 33 28.2 16 13.7 6 5.1 36 17.8 FPW 33 28.2 16 13.7 6 5.1 36 17.8 FSE 114 97.4 31 26.5 3 2.6 192 95.0 INO 82 70.1 33 28.2 12 10.3 114 56.4 MR2 32 27.4 4 3.4 5 4.3 33 16.3 NAV 108 92.3 36 30.8 8 6.8 163 80.7 NVC 24 20.5 0 0.0 3 2.6 32 15.8 PRO 31 26.5 4 3.4 8 6.8 37 18.3 RAV 96 82.1 12 10.3 10 8.5 145 71.8 SCN 115 98.3 10 8.5 4 3.4 188 93.1 VSP 32 27.4 4 3.4 5 4.3 33 16.3 ----------------------------------------------------------- Mean 51.4% 44.1% Mean (rate>10%) 54.4% 46.6% -----------------------------------------------------------