================================================ File 6lLinux.TXT: Detailed results of File and Macro Virus related on-demand scanner tests under Linux (SuSe edition): =================================================== (Formatted with non-proportional font: Courier; 72 columns) The following *5* products (versions) participated in aVTCs first Linux test (for details of related AV producers: see A2SCNLS.txt): ================================================ AVP v: 3.0 build 135.2 sig: Dec.05, 2000 CMD v: 4.60.0 sig: Dec.11, 2000 FSE v: 4.09 build 2351 sig: Dec.07, 2000 RAV v: 8.0.005 scaneng 8.3 sig: Dec.11, 2000 SCN v: 4.12.0 scaneng4.1.20 sig: Dec.06, 2000 ================================================= The following tables summarize detection and identification quality concerning FILE and MACRO viruses as well as selected FILE and MACRO MALWARE, both in full "zoo" virus collection and for viral ITW testbed. Additionally, test results are reported concerning detection of (4*10,000) viruses in a testbed with generations of 6 polymorphic file viruses, as well as a subset of 10,706 viruses generated from VKIT virus construction kit. Moreover, results for detection of viruses in files compressed with 6 popular packing methods are also given. Finally, special tests were performed concerning "false positive" virus detection of selected files which were deliberately chosen from available CD-ROMs and which were definitively clean of viruses, and the detection rate for a selection of malware on several other platforms ("exotic") was also determined. For discussion of results, see 6ASUMOV.TXT and 7EVAL.TXT. Results may be influenced by problems experienced during tests; such problems are documented in 8PROBLMS.TXT. Index of tables: ---------------- LIN.F1: "FileVirus 1": Results of "full" Zoo test for file viruses LIN.F2: "FileVirus 2": Results of "In-The-Wild" test for file viruses LIN.FA: "Polyfile-Test": Results of Polymorphic test LIN.FB: "VKIT Test": Results of VKIT file virus test LIN.F3V: "Comparison of Detection Rate of Packed Viruses": Results of Detection Rate of ITW file viruses packed with PKZIP, LHA, ARJ and RAR LIN.F3F: "Comparison of Detection Rate of Packed Viral Objects": Results of Detection Rate of objects infected with ITW file viruses and packed with PKZIP, LHA, ARJ and RAR LIN.F3a: "PKZIP-Packed File Viruses": Results of Detection of ITW File Viruses Packed wiith PKZIP LIN.F3b: "LHA-Packed File Viruses": Results of Detection of ITW File Viruses Packed with LHA LIN.F3c: "ARJ-Packed File Viruses": Results of Detection of ITW File Viruses Packed with ARJ LIN.F3d: "RAR-Packed File Viruses": Results of Detection of ITW File Viruses Packed with RAR LIN.F3e: "WinRAR-Packed File Viruses": Results of Detection of ITW File Viruses Packed with WinRAR LIN.F3f: "CAB-Packed File Viruses": Results of Detection of ITW File Viruses Packed with CAB LIN.F4: "False Positive" detection: Results of "full" Zoo test for non-viral (clean) file samples detected as "False positives" LIN.F5 "File Malware": Results of "full" Zoo test for File-related malware LIN.M1: "MacroVirus 1": Results of "full" test for macro viruses LIN.M2: "MacroVirus 2": Results of "In-The-Wild" test for macro viruses LIN.M3: "Comparison of Detection Rate of Packed Viruses": Results of Detection Rate of ITW file viruses packed with PKZIP, LHA, ARJ and RAR LIN.M3a: "PKZIP-Packed Macro Viruses": Results of Detection of ITW macro Viruses Packed with PKZIP LIN.M3b: "LHA-Packed Macro Viruses": Results of Detection of ITW macro Viruses Packed with LHA LIN.M3c: "ARJ-Packed Macro Viruses": Results of Detection of ITW macro Viruses Packed with ARJ LIN.M3d: "RAR-Packed Macro Viruses": Results of Detection of ITW macro Viruses Packed with RAR LIN.M3e: "WinRAR-Packed Macro Viruses": Results of Detection of ITW macro Viruses Packed with WinRAR LIN.M3f: "CAB-Packed Macro Viruses": Results of Detection of ITW macro Viruses Packed with CAB LIN.M4: "False Positive" detection: Results of "full" zoo test for non-viral (clean) macro objects detected as "false positives" LIN.M5: "Macro-Malware": Results of "full" zoo test for Macro-related malware LIN.S1: "ScriptVirus 1": Results of "full" test for script viruses (VBS, JS etc) LIN.S2: "ScriptVirus 2": Results of "In-The-Wild" test for script viruses LIN.E1: "Exotic" malware Table LIN.F1: "FileVirus 1": Results of "full" test for file viruses: =================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 20564 100.0 150703 100.0 ---------------------------------------------------------- AVP 20539 99.9 595 2.9 13 0.1 150584 99.9 CMD 20111 97.8 56 0.3 62 0.3 148730 98.7 FSE 19967 97.1 77 0.4 73 0.4 148186 98.3 RAV 19234 93.5 783 3.8 608 3.0 139515 92.6 SCN 20501 99.7 275 1.3 20 0.1 150366 99.8 ----------------------------------------------------------- Table LIN.F2: "FileVirus 2": Results of "In-The-Wild" test for file viruses: ===================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 20 100.0 409 100.0 ---------------------------------------------------------- AVP 20 100.0 1 5.0 0 0.0 409 100.0 CMD 20 100.0 0 0.0 0 0.0 409 100.0 FSE 20 100.0 0 0.0 0 0.0 409 100.0 RAV 20 100.0 3 15.0 2 10.0 404 98.8 SCN 20 100.0 1 5.0 0 0.0 409 100.0 ----------------------------------------------------------- Table LIN.FA: "Polyfile-Test": Results of detection test for polymorphic file viruses ======================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Maximum 6 100.0 % % 60000 100.0 ---------------------------------------------------------- AVP 6 100.0 0 0.0 0 0.0 60000 100.0 CMD 6 100.0 1 16.7 0 0.0 60000 100.0 FSE 6 100.0 1 16.7 0 0.0 60000 100.0 RAV 6 100.0 1 16.7 0 0.0 60000 100.0 SCN 6 100.0 6 100.0 0 0.0 60000 100.0 ---------------------------------------------------------- Remark: For 6 polymorphic viruses (with Maltese Amoeba, MTE.Encroacher.B, NATAS, TREMOR, One-Half and Tequila as in the previous test), 10,000 generations each were produced with VTCs dynamic polymorphic generation and test engine. For each virus, 100 directories including infected objects with goat files of lengths ranging from 1 kByte to 100 kByte were generated. Table LIN.FB: "VKIT Test": Results of VKIT file virus test: =========================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 10706 100.0 104640 100.0 ---------------------------------------------------------- AVP 10706 100.0 1194 11.2 0 0.0 104640 100.0 CMD 10706 100.0 5721 53.4 3 0.0 104636 100.0 FSE 10706 100.0 1003 9.4 3 0.0 104636 100.0 RAV 10706 100.0 221 2.1 178 1.7 104247 99.6 SCN 10706 100.0 31 0.3 0 0.0 104640 100.0 ----------------------------------------------------------- Remark: A testbed of 10,706 viruses generated with the VKIT virus generator (out of about 14,000 viruses which can be generated) was used to test detection quality. This test was separated from the "normal" file virus test as 1) there is no agreement between AV producers whether viruses from VKIT should be counted just as 1 or as 14,000 different viruses (boasting number of detected viruses to over 40,000), and 2) because of the large size of this special testbed. Table LIN.F3V: "Comparison of Detection Rate of Packed Viruses": Results of Detection Rate of ITW file viruses packed with PKZIP, LHA, ARJ, RAR, WinRAR and CAB: ================================================================= This includes Viruses detected per packer ------------------------------------------------------------------------- ZIP % LHA % ARJ % RAR % WRAR % CAB % TestBed 20 100.0 20 100.0 20 100.0 20 100.0 20 100.0 20 100.0 ------------------------------------------------------------------------- AVP 20 100.0 20 100.0 20 100.0 20 100.0 20 100.0 20 100.0 CMD 20 100.0 20 100.0 20 100.0 20 100.0 20 100.0 20 100.0 FSE 20 100.0 20 100.0 20 100.0 0 0.0 0 0.0 0 0.0 RAV 20 100.0 0 0.0 20 100.0 20 100.0 20 100.0 20 100.0 SCN 20 100.0 20 100.0 20 100.0 20 100.0 20 100.0 20 100.0 ------------------------------------------------------------------------- Table LIN.F3F: "Comparison of Detection Rate of Packed Viral Objects": Results of Detection Rate of objects infected with ITW file viruses and packed with PKZIP, LHA, ARJ, RAR WinRAR and CAB =========================================================================== This includes Viral objects detected per packer ------------------------------------------------------------------------------- ZIP % LHA % ARJ % RAR % WRAR % CAB % TestBed 409 100.0 409 100.0 409 100.0 409 100.0 409 100.0 409 100.0 ------------------------------------------------------------------------------- AVP 409 100.0 409 100.0 409 100.0 409 100.0 409 100.0 409 100.0 CMD 409 100.0 409 100.0 409 100.0 409 100.0 409 100.0 409 100.0 FSE 409 100.0 409 100.0 409 100.0 0 0.0 0 0.0 0 0.0 RAV 404 98.8 0 0.0 404 98.8 402 98.3 404 98.8 404 98.8 SCN 409 100.0 409 100.0 409 100.0 409 100.0 409 100.0 409 100.0 ------------------------------------------------------------------------------- Table LIN.F3a: "PKZIP-Packed File Viruses": Results of Detection of ITW File Viruses Packed with PKZIP: ================================================================ This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 20 100.0 409 100.0 ---------------------------------------------------------- AVP 20 100.0 1 5.0 0 0.0 409 100.0 CMD 20 100.0 0 0.0 0 0.0 409 100.0 FSE 20 100.0 0 0.0 0 0.0 409 100.0 RAV 20 100.0 3 15.0 2 10.0 404 98.8 SCN 20 100.0 0 0.0 0 0.0 409 100.0 ----------------------------------------------------------- Table LIN.F3b: "LHA-Packed File Viruses": Results of Detection of ITW File Viruses Packed with LHA: ============================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 20 100.0 409 100.0 ---------------------------------------------------------- AVP 20 100.0 1 5.0 0 0.0 409 100.0 CMD 20 100.0 1 5.0 0 0.0 409 100.0 FSE 20 100.0 0 0.0 0 0.0 409 100.0 RAV 0 0.0 0 0.0 0 0.0 0 0.0 SCN 20 100.0 0 0.0 0 0.0 409 100.0 ----------------------------------------------------------- Table LIN.F3c: "ARJ-Packed File Viruses": Results of Detection of ITW File Viruses Packed with ARJ: ============================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 20 100.0 409 100.0 ---------------------------------------------------------- AVP 20 100.0 1 5.0 0 0.0 409 100.0 CMD 20 100.0 0 0.0 0 0.0 409 100.0 FSE 20 100.0 0 0.0 0 0.0 409 100.0 RAV 20 100.0 3 15.0 2 10.0 404 98.8 SCN 20 100.0 1 5.0 0 0.0 409 100.0 ----------------------------------------------------------- Table LIN.F3d: "RAR-Packed File Viruses": Results of Detection of ITW File Viruses Packed with RAR: ============================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 20 100.0 409 100.0 ---------------------------------------------------------- AVP 20 100.0 1 5.0 0 0.0 409 100.0 CMD 20 100.0 0 0.0 0 0.0 409 100.0 FSE 0 0.0 0 0.0 0 0.0 0 0.0 RAV 20 100.0 3 15.0 2 10.0 402 98.3 SCN 20 100.0 0 0.0 0 0.0 409 100.0 ----------------------------------------------------------- Table LIN.F3e: "WinRAR-Packed File Viruses": Results of Detection of ITW File Viruses Packed with WinRAR: ================================================================= This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 20 100.0 409 100.0 ---------------------------------------------------------- AVP 20 100.0 1 5.0 0 0.0 409 100.0 CMD 20 100.0 0 0.0 0 0.0 409 100.0 FSE 0 0.0 0 0.0 0 0.0 0 0.0 RAV 20 100.0 3 15.0 2 10.0 404 98.8 SCN 20 100.0 0 0.0 0 0.0 409 100.0 ----------------------------------------------------------- Table LIN.F3f: "CAB-Packed File Viruses": Results of Detection of ITW File Viruses Packed with CAB: ============================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ----------------------------------------------------------- Testbed 20 100.0 409 100.0 ---------------------------------------------------------- AVP 20 100.0 1 5.0 0 0.0 409 100.0 CMD 20 100.0 0 0.0 0 0.0 409 100.0 FSE 0 0.0 0 0.0 0 0.0 0 0.0 RAV 20 100.0 3 15.0 2 10.0 404 98.8 SCN 20 100.0 0 0.0 0 0.0 409 100.0 ----------------------------------------------------------- Table LIN.F4: "False Positive" detection: Results of "full" Zoo test for Non-viral (clean) samples detected as "false positives": =========================================================== False This includes Virus ---- unreliably ---- Files Scanner Alarm identified detected detected ---------------------------------------------------------- Maximum 27 100.0 664 100.0 ---------------------------------------------------------- AVP 0 0.0 0 0.0 0 0.0 0 0.0 CMD 0 0.0 0 0.0 0 0.0 0 0.0 FSE 0 0.0 0 0.0 0 0.0 0 0.0 RAV 0 0.0 0 0.0 0 0.0 0 0.0 SCN 0 0.0 0 0.0 0 0.0 0 0.0 ---------------------------------------------------------- Remark: within 38 non-viral directories and totally 1851 non- viral objects, at least one sample in N directories was falsely detected (N = number in column 1) Table LIN.F5 "File Malware": Results of "full" Zoo test for File-related malware: ================================================== File This includes Malware ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 6250 100.0 12160 100.0 ---------------------------------------------------------- AVP 6023 96.4 398 6.4 44 0.7 11676 96.0 CMD 5872 94.0 62 1.0 125 2.0 11326 93.1 FSE 5410 86.6 91 1.5 161 2.6 10445 85.9 RAV 5036 80.6 215 3.4 192 3.1 9232 75.9 SCN 5568 89.1 86 1.4 32 0.5 11071 91.0 ----------------------------------------------------------- Table LIN.M1: "MacroVirus 1": Results of "full" Zoo test for macro viruses: =============================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 6233 100.0 19387 100.0 ---------------------------------------------------------- AVP 6230 100.0 91 1.5 2 0.0 19381 100.0 CMD 6233 100.0 72 1.2 0 0.0 19387 100.0 FSE 6231 100.0 7 0.1 0 0.0 19371 99.9 RAV 6208 99.6 309 5.0 10 0.2 19309 99.6 SCN 6233 100.0 11 0.2 0 0.0 19387 100.0 ----------------------------------------------------------- Table LIN.M2: "MacroVirus 2": Results of "In-The-Wild" test for macro viruses: ========================================================= This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 147 100.0 1347 100.0 ---------------------------------------------------------- AVP 147 100.0 8 5.4 0 0.0 1347 100.0 CMD 147 100.0 5 3.4 0 0.0 1347 100.0 FSE 146 99.3 0 0.0 0 0.0 1343 99.7 RAV 147 100.0 31 21.1 1 0.7 1346 99.9 SCN 147 100.0 1 0.7 0 0.0 1347 100.0 ----------------------------------------------------------- Table LIN.M3V: "Comparison of Detection Rate of Packed Viruses": Results of Detection Rate of ITW macro viruses packed with PKZIP, LHA, ARJ, RAR, WinRAR and CAB: ================================================================ This includes Viruses detected per packer ------------------------------------------------------------------------------ ZIP % LHA % ARJ % RAR % WRAR % CAB % ------------------------------------------------------------------------------ Testbed 147 100.0 147 100.0 147 100.0 147 100.0 147 100.0 147 100.0 ------------------------------------------------------------------------------ AVP 147 100.0 147 100.0 147 100.0 147 100.0 147 100.0 147 100.0 CMD 147 100.0 147 100.0 147 100.0 147 100.0 147 100.0 147 100.0 FSE 146 99.3 146 99.3 146 99.3 0 0.0 0 0.0 0 0.0 RAV 147 100.0 0 0.0 147 100.0 147 100.0 146 99.3 147 100.0 SCN 147 100.0 147 100.0 147 100.0 147 100.0 147 100.0 147 100.0 ------------------------------------------------------------------------------ Table LIN.M3F: "Comparison of Detection Rate of Packed Viral Objects": Results of Detection Rate of objects infected with ITW file viruses and with PKZIP, LHA, ARJ, RAR, WinRAR, CAB ======================================================================= This includes Viral objects detected per packer ------------------------------------------------------------------------------- ZIP % LHA % ARJ % RAR % WRAR % CAB % ------------------------------------------------------------------------------- Testbed 1347 100.0 1347 100.0 1347 100.0 1347 100.0 1347 100.0 1347 100.0 ------------------------------------------------------------------------------- AVP 1347 100.0 1347 100.0 1347 100.0 1347 100.0 1347 100.0 1269 94.2 CMD 1347 100.0 1347 100.0 1347 100.0 1347 100.0 1347 100.0 1347 100.0 FSE 1343 99.7 1343 99.7 1343 99.7 0 0.0 0 0.0 0 0.0 RAV 1346 99.9 0 0.0 1346 99.9 1342 99.6 1246 92.5 1346 99.9 SCN 1347 100.0 1347 100.0 1347 100.0 1347 100.0 1347 100.0 1347 100.0 ------------------------------------------------------------------------------- Table LIN.M3a: "PKZIP-Packed Macro Viruses": Results of Detection of ITW Macro Viruses Packed with PKZIP: ================================================================= This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 147 100.0 1347 100.0 ---------------------------------------------------------- AVP 147 100.0 8 5.4 0 0.0 1347 100.0 CMD 147 100.0 0 0.0 0 0.0 1347 100.0 FSE 146 99.3 0 0.0 0 0.0 1343 99.7 RAV 147 100.0 31 21.1 1 0.7 1346 99.9 SCN 147 100.0 6 4.1 0 0.0 1347 100.0 ---------------------------------------------------------- Table LIN.M3b: "LHA-Packed Macro Viruses": Results of Detection of ITW Macro Viruses Packed with LHA: =============================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 147 100.0 1347 100.0 ---------------------------------------------------------- AVP 147 100.0 8 5.4 0 0.0 1347 100.0 CMD 147 100.0 0 0.0 0 0.0 1347 100.0 FSE 146 99.3 0 0.0 0 0.0 1343 99.7 RAV 0 0.0 0 0.0 0 0.0 0 0.0 SCN 147 100.0 6 4.1 0 0.0 1347 100.0 ---------------------------------------------------------- Table LIN.M3c: "ARJ-Packed Macro Viruses": Results of Detection of ITW Macro Viruses Packed with ARJ: =============================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 147 100.0 1347 100.0 ---------------------------------------------------------- AVP 147 100.0 8 5.4 0 0.0 1347 100.0 CMD 147 100.0 0 0.0 0 0.0 1347 100.0 FSE 146 99.3 0 0.0 0 0.0 1343 99.7 RAV 147 100.0 31 21.1 1 0.7 1346 99.9 SCN 147 100.0 6 4.1 0 0.0 1347 100.0 ----------------------------------------------------------- Table LIN.M3d: "RAR-Packed Macro Viruses": Results of Detection of ITW Macro Viruses Packed with RAR: =============================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 147 100.0 1347 100.0 ---------------------------------------------------------- AVP 147 100.0 8 5.4 0 0.0 1347 100.0 CMD 147 100.0 0 0.0 0 0.0 1347 100.0 FSE 0 0.0 0 0.0 0 0.0 0 0.0 RAV 147 100.0 29 19.7 5 3.4 1342 99.6 SCN 147 100.0 6 4.1 0 0.0 1347 100.0 ---------------------------------------------------------- Table LIN.M3e: "WinRAR-Packed Macro Viruses": Results of Detection of ITW Macro Viruses Packed with WinRAR: ================================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 147 100.0 1347 100.0 ---------------------------------------------------------- AVP 147 100.0 8 5.4 0 0.0 1347 100.0 CMD 147 100.0 0 0.0 0 0.0 1347 100.0 FSE 0 0.0 0 0.0 0 0.0 0 0.0 RAV 146 99.3 29 19.7 3 2.0 1246 92.5 SCN 147 100.0 6 4.1 0 0.0 1347 100.0 ---------------------------------------------------------- Table LIN.M3f: "CAB-Packed Macro Viruses": Results of Detection of ITW Macro Viruses Packed with CAB: =============================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 80 100.0 672 100.0 ---------------------------------------------------------- AVP 147 100.0 7 4.8 7 4.8 1269 94.2 CMD 147 100.0 0 0.0 0 0.0 1347 100.0 FSE 0 0.0 0 0.0 0 0.0 0 0.0 RAV 147 100.0 31 21.1 1 0.7 1346 99.9 SCN 147 100.0 6 4.1 0 0.0 1347 100.0 ---------------------------------------------------------- Table LIN.M4: "False Positive" macro virus detection: Results of "full" zoo test for non-viral (clean) macro objects detected as "false positives": ============================================================= False This includes Virus ---- unreliably ---- Files Scanner Alarm identified detected detected ---------------------------------------------------------- Maximum 26 100.0 329 100.0 ---------------------------------------------------------- AVP 0 0.0 0 0.0 0 0.0 0 0.0 CMD 1 3.8 0 0.0 1 3.8 2 0.6 FSE 1 3.8 0 0.0 1 3.8 2 0.6 RAV 0 0.0 0 0.0 0 0.0 0 0.0 SCN 0 0.0 0 0.0 0 0.0 0 0.0 ----------------------------------------------------------- Remark: within 26 non-viral directories and totally 329 non- viral objects, at least one sample in N directories was falsely detected (N = number in column 1) Table LIN.M5: "Macro-Malware": Results of "full" test for Macro-related malware: ================================================ Macro This includes Malware ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 403 100.0 627 100.0 ---------------------------------------------------------- AVP 400 99.3 0 0.0 0 0.0 624 99.5 CMD 402 99.8 6 1.5 0 0.0 621 99.0 FSE 402 99.8 2 0.5 0 0.0 621 99.0 RAV 391 97.0 23 5.7 5 1.2 604 96.3 SCN 402 99.8 0 0.0 0 0.0 626 99.8 ----------------------------------------------------------- Table LIN.S1: "ScriptVirus 1": Results of "full" Zoo test for script viruses: ================================================= This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 477 100.0 904 100.0 ---------------------------------------------------------- AVP 476 99.8 32 6.7 1 0.2 901 99.7 CMD 462 96.9 1 0.2 12 2.5 848 93.8 FSE 462 96.9 9 1.9 17 3.6 845 93.5 RAV 405 84.9 46 9.6 28 5.9 697 77.1 SCN 476 99.8 3 0.6 2 0.4 896 99.1 ----------------------------------------------------------- Table LIN.M2: "ScriptVirus 2": Results of "In-The-Wild" test for script viruses: ======================================================= This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 16 100.0 133 100.0 ---------------------------------------------------------- AVP 16 100.0 2 12.5 0 0.0 133 100.0 CMD 16 100.0 0 0.0 4 25.0 125 94.0 FSE 16 100.0 0 0.0 6 37.5 125 94.0 RAV 16 100.0 4 25.0 5 31.3 115 86.5 SCN 16 100.0 1 6.3 0 0.0 133 100.0 ---------------------------------------------------------- Table LIN.E1: "Exotic Malware": Results of special test for exotic viruses: ================================================== This includes Viruses ---- unreliably ---- Files Scanner detected identified detected detected ---------------------------------------------------------- Testbed 115 100.0 274 100.0 ---------------------------------------------------------- AVP 104 90.4 3 2.6 0 0.0 252 92.0 CMD 77 67.0 1 0.9 5 4.3 130 47.4 FSE 17 14.8 1 0.9 3 2.6 59 21.5 RAV 85 73.9 3 2.6 6 5.2 184 67.2 SCN 62 53.9 1 0.9 3 2.6 185 67.5 ----------------------------------------------------------