Re: how broken are antivirus products?

oh yeah, as an additional piece of data. i have obtained about 22Mb of an mbox file from a friend containing electronic mail viruses. the sophpos sweep reports:

1 file swept in 4 seconds.
No viruses were discovered.
End of Sweep.

antivir reports:

 Date: 16.11.2002 Time: 11:08:40 Size: 22385109  ALERT: [VBS/SST-A_#3 virus] jose <<< Contains signature of the VBS script virus VBS/SST-A_#3

this file represents about 76 mail messages containing viruses (not all unique, but over 50 unique mail bourne viruses and worms).

disappointing, to say the least.

jose nazario, ph.d.			jose@monkey.org
					
http://www.monkey.org/~jose/