[comp.virus] McAfee on VSUM accuracy and Microcom

mcafee@netcom.com (McAfee Associates) (06/26/91)

The following message is forwarded from John McAfee:

     I regret that I haven't had much time to keep up with Virus-L
recently, especially since it is one of the more informative sources
of virus information.  Fortunately, Aryeh Goretsky, Morgan Schweers,
Fritz Schneider and others have been kind enough to digest the bulk of
the Virus-L information and forward to me bits and pieces that they
feel my feeble mind can manage.
           A couple of postings made recently by Terry Reeves Ross
Greenburg need a response.  Specifically:

>From:   treeves@magnus.acs.ohio-state.edu (Terry N Reeves)
>Vsum still says no utility will remove joshi and that a low level
>format is required.....
>     Is there a utility Ms. Hoffman?  perhaps you just don't want to
>admit it because McAffe's can't?  (i have not tried McAfee but I
assume >she'd say if his did.)

The McAfee Clean-Up program has been able to cure the Joshi since the
Joshi first appeared more than ten months ago.  What is curious about
this message is that Terry has not tried our product, yet tacitly
assumes that it cannot perform a given function.  The reason he gives
for this assumption is that the VSUM author doesn't want to admit that
anyone could cure the Joshi because McAfee cannot.  Have we really
reached this level of acrimony within this industry?  Isn't it enough
that most of us are trying our best to thwart a growing number of
virus writers and an escalating infection incidence?  Is there that
much spare energy left to throw stones at people like Patricia
Hoffman?  If Patricia, who works harder at analyzing and reporting
viruses than anyone I know, is now a flame target, then what's left?
I have been aware that VSUM did not report a disinfector for Joshi
(even though Clean-Up had been disinfecting it for 8 releases of VSUM)
but so what?  Out of 500,000 bytes of fine reporting in VSUM, should I
be so insecure that I have to correct Patricia's document so the world
will know that the McAfee products disinfect yet another virus?  Is
there really time and energy for such trivia?

And the second posting:

>From:  Ross Greenburg
>One of the interesting things:  Microcom, the people who publish and
>market my code, is expressly forbidden from using McAfee products by
>the vendor itself.

This is news to the alleged vendor.  Since McAfee Associates is the
only vendor of the McAfee products I assume Ross means us.  We have
never refused to sell our products to anyone, and our policies will
not change.  It's a strange comment considering that 99.9% of all of
our users use our products without telling us or paying us anyway (one
of the side effects of shareware).  How would we ever know?

In any case, it's good to exercise my fingers again and communicate
with this growing body of concerned persons.  My best wishes to my
detractors (many), admirers (few) and lethargics (the silent majority)
alike.

- - - -
End of forwarded message.

While John is not regularly on the Internet, I will forward any replies
to him, however, it would probably be best to contact him directly via
telephone or fax at any of the numbers below.

Aryeh Goretsky
McAfee Associates Technical Support

c-rossgr@microsoft.COM (06/27/91)

>From:    mcafee@netcom.com (McAfee Associates)
>
>>From:  Ross Greenburg
>>One of the interesting things:  Microcom, the people who publish and
>>market my code, is expressly forbidden from using McAfee products by
>>the vendor itself.

> We have
>never refused to sell our products to anyone, and our policies will
>not change.  It's a strange comment considering that 99.9% of all of
>our users use our products without telling us or paying us anyway (one
>of the side effects of shareware).  How would we ever know?

This is good news.  I was under the impression that Microcom attempted
to license a copy from you and was told that they may not use it
without a license and that a license would not be issued to Microcom
under any circumstances.

I am glad that the information given to me is false and that Microcom
is expressly being given permission to utilize this product from the
vendor.  I would presume there is a charge for such usage: what would
that charge be for *only* one computer to use your product? I'll be
sure to report that amount to the Microcom people I deal with.

Ross

BLSCOLLO@OCC.BITNET (Bonnie Scollon) (06/27/91)

 John McAfee writes:

 >This is news to the alleged vendor.  Since McAfee Associates is the
 >only vendor of the McAfee products I assume Ross means us.  We have
 >never refused to sell our products to anyone, and our policies will
 >not change.  It's a strange comment considering that 99.9% of all of
 >our users use our products without telling us or paying us anyway (one
 >of the side effects of shareware).  How would we ever know?

This is not true. As the college virus tracker, I try to keep
up-to-date copies of most anti-viral products. Of course, I can obtain
copies of McAfee'ssoftware but when I try to pay the fee, I get back a
form letter saying they will not sell a single copy to a college -- we
must spend thousands to obtain a site license for ALL our PC's,
whether we would install the programs or not. If this is not a refusal
to sell, I would not know what else to call it.

We have a site license from another vendor which was considerably
cheaper.  Even that one is quite expensive considering that we don't
actually use the product on all the college computers. We are also
looking into a site license for F-PROT, since that is certainly the
cheapest site license around.

I did notice the inaccuracy in VSUM's Joshi listing. I, too, did not
want to nitpick a document that obviously requires great time and
effort to produce. I have tested several products with the Joshi virus
and all can now remove it. I have not been keeping up with my VIRUS-L
reading or I would have responded to that posting. CPAV, Vi-Spy and
F-PROT will all find and remove it. My copy of Virex-PC did not but
the dates on the files are over a year old, even though we purchased
from Egghead only 4 months ago. (I have never received any update
info). I do not remember if NAV removed it or not. I rarely use it any
more in tests since it performed poorly when first tried.

 Bonnie Scollon
 Oakland Community College
 (in Oakland County MICHIGAN, not California)