[comp.virus] VirusDetective questions

awinterb@udenva.cair.du.edu (Richard Nixon) (09/19/89)

Has anyone used VirusDetective for the Mac?  We've
used it, but it seems to detect viruses in files that
we doubt are affected.

How reliable is this bit of software?

                   ...!ncar!udenva!awinterb
                     or according to rumor
                        awinterb@du.edu

dmg@lid.mitre.org (David Gursky) (09/20/89)

What version are you using?  The latest and greatest is 3.0.1.  I've
been using it with no problems.  [On the other hand, the systems I am
using it on are clean according to it and Disinfectant 1.2...]

shulman@uunet.UU.NET (Jeff Shulman) (09/20/89)

awinterb@udenva.cair.du.edu (Richard Nixon) writes:

>Has anyone used VirusDetective for the Mac?  We've
>used it, but it seems to detect viruses in files that
>we doubt are affected.

I have (but then again I wrote it! <standard disclaimers>).
VirusDetective (VD) is only as good as the search strings used.  VD
3.0.1 (the latest) is distributed with search strings that detect all
known *active* Mac viruses.  With the latest search patterns I have
seen NO cases of "false" alarms.  Some earlier search strings (say
CODE Size xxx) to test for a virus *could* match legitimate CODE
resources.  So, without knowing what version you are running nor the
search strings you are using you may very well be getting matches
where no virus actually exists.  Standard example of Garbage In,
Garbage Out.

>How reliable is this bit of software?

I have not seen any known virus get past VD 3.0.1.  VD is the only
program (to my knowledge) that can be user configured to search for
any new virus (or *any* resource for that matter) as soon as a virus
is discovered thus you do not need to obtain a new version (costing $$
from commercial vendors) when a new virus is discovered.  NOTE: I *do*
send out notification of new search strings to my registered users but
you are apt to see them in Usenet first.

                                               Jeff Shulman
                                               VirusDetective author
- --
uucp:      ...rutgers!yale!slb-sdr!shulman
CSNet:     SHULMAN@SDR.SLB.COM
Delphi:    JEFFS
GEnie:     KILROY
CIS:       76136,667
AppleLink: KILROY

Disclaimer:  VD has absolutely nothing to do with my "day" job at SDR and
opinions, etc. herein should not be construed as coming from SDR.

henry@att.att.com (09/21/89)

In article <0004.8909191146.AA07427@ge.sei.cmu.edu> awinterb@udenva.cair.du.edu
 (Richard Nixon) writes:
>Has anyone used VirusDetective for the Mac?  We've
>used it, but it seems to detect viruses in files that
>we doubt are affected.
>
>How reliable is this bit of software?

How certain are you that these files are not infected?  Have you
checked them with other programs such as Disinfectant and Virus RX?

The latest version of VirusDetective (3.0.1 if memory serves) seems
quite reliable.  It was the program with which I discovered the nVIR
A infection on the disk which came with the Brady Utility book
_Applied HyperTalk_.

If VD is reporting a virus, I'd be sure to check those files with
another detection utility before dismissing it as a false alarm.
I'm not saying that VD will never give a false alarm, but since the
different utilities use different detection methods the probability
of both giving false alarms on the same file is small.

Personally I never trust only one program to tell me whether or not
I have a virus.  I run at least two on a weekly basis.

			Henry C. Schmitt
			Author of Virus Encyclopedia
  H3nry C. Schmitt     | CompuServe: 72275,1456  (Rarely)
                       | GEnie: H.Schmitt  (Occasionally)
 Royal Inn of Yoruba   | UUCP: Henry@chinet.chi.il.us  (Best Bet)