Virus test report (C) Marko Helenius 5.4.1994

For the very first time in Anti-Virus testing history there
is available a detailed report of whole virus test set used
in the tests. The report includes, which product identified
which virus and by which name. These tests are carried out
without manipulating virus test set in any way. Files, which
were not viruses were however excluded.


Scanning test

The scanning test was performed against 2671 file viruses.
Some viruses can infect both COM- and EXE- files and for
this reason there were both COM- and EXE- files of some
viruses. The test set included totally 3024 infected files.
Trojan Horses, Dropper programs and Joke programs were
excluded. Heuristic scanning and checksum calculation was
disabled.

Product                        Infected files    Percentage
                               detected
Dr. Solomon's Anti-Virus       3020 of 3024      99,9 %
Toolkit v.6.51
F-Prot Professional v. 2.11a   2985 of 3024      98,7 %
Sophos Sweep v.2.59            2929 of 3024      96,9 %
Thunderbyte v.6.11             2770 of 3024      91,6 %
McAfee Scan 9.24 v 113         2769 of 3024      91,6 %
Norton Anti-Virus v.3.0        2350 of 3024      77,8 %
Central Point Anti-Virus v.2.0 2073 of 3024      68,6 %


Test of memory resident scanners:

This test was carried out by copying files when memory
resident portion of product was loaded. Sweep does not
provide memory resident scanner.

Product                           Infected files   Percentage
                                  detected
Virus Guard (Anti-Virus Toolkit   2915 of 3024       96,4 %
v.6.51)
TbscanX (Thunderbyte v.6.11)      2600 of 3024       86,0 %
Virstop (F-Prot Professional v.   2573 of 3024       85,1 %
2.11a)
NavTSR (Norton Anti-Virus         2350 of 3024       77,8 %
v.3.0)
Vshield (McAfee Scan 9.24 v       1741 of 3024       57,6 %
113)
Vsafe (Central Point Anti-Virus   1651 of 3024       54,6 %
v.2.0)


Polymorphic virus tests

These tests were carried out by generating files of random
sizes and then infecting them by some MtE (Self Mutating
Engine) or TPE (Trident Polymorphic Engine) based
polymorphic virus. Files, which were not infected or were
damaged were excluded. In these tests were used TPE.Girafe,
TPE.Civil_War, TPE.Bosnia, MtE.Groove, MtE.Coffee, MtE.Pogue
and MtE.Fear viruses.


MtE.Groove (774 infected COM-files)

Product                         Infected files     Percentage
                                detected
Dr. Solomon's Anti-Virus        774 of 774         100 %
Toolkit v.6.51
F-Prot Professional v. 2.11a    774 of 774         100 %
Sophos Sweep v.2.59             774 of 774         100 %
Thunderbyte v.6.11              774 of 774         100 %
McAfee Scan 9.24 v 113          774 of 774         100 %
Norton Anti-Virus v.3.0         774 of 774         100 %
Central Point Anti-Virus v.2.0  710 of 774         91,7 %


MtE.Coffee (421 infected EXE-files)

Product                         Infected files     Percentage
                                detected
Dr. Solomon's Anti-Virus        421 of 421         100 %
Toolkit v.6.51
F-Prot Professional v. 2.11a    421 of 421         100 %
Sophos Sweep v.2.59             421 of 421         100 %
Thunderbyte v.6.11              421 of 421         100 %
McAfee Scan 9.24 v 113          416 of 421         98,8 %
Norton Anti-Virus v.3.0         403 of 421         95,7 %
Central Point Anti-Virus v.2.0  383 of 421         91,0 %


MtE.Pogue (365 infected COM-files)

Product                         Infected files     Percentage
                                detected
Dr. Solomon's Anti-Virus        365 of 365         100 %
Toolkit v.6.51
F-Prot Professional v. 2.11a    365 of 365         100 %
Sophos Sweep v.2.59             365 of 365         100 %
Thunderbyte v.6.11              365 of 365         100 %
McAfee Scan 9.24 v 113          365 of 365         100 %
Norton Anti-Virus v.3.0         365 of 365         100 %
Central Point Anti-Virus v.2.0  331 of 365         90,7 %


MtE.Fear (90 infected COM-files)

Product                         Infected files     Percentage
                                detected
Dr. Solomon's Anti-Virus        90 of 90           100 %
Toolkit v.6.51
F-Prot Professional v. 2.11a    90 of 90           100 %
Sophos Sweep v.2.59             90 of 90           100 %
Thunderbyte v.6.11              90 of 90           100 %
McAfee Scan 9.24 v 113          90 of 90           100 %
Norton Anti-Virus v.3.0         90 of 90           100 %
Central Point Anti-Virus v.2.0  81 of 90           90 %


TPE.Girafe (1525 infected EXE-files)

Product                         Infected files     Percentage
                                detected
Dr. Solomon's Anti-Virus        1525 of 1525       100 %
Toolkit v.6.51
McAfee Scan 9.24 v 113          1525 of 1525       100 %
Sophos Sweep v.2.59             1525 of 1525       100 %
Thunderbyte v.6.11              1523 of 1525       99,9 %
Norton Anti-Virus v.3.0         1500 of 1525       98,4 %
F-Prot Professional v. 2.11a    1452 of 1525       95,2 %
Central Point Anti-Virus v.2.0  0 of 1525          0 %


TPE.Civil_War (419 infected COM-files)

Product                         Infected files     Percentage
                                detected
Dr. Solomon's Anti-Virus        419 of 419         100 %
Toolkit v.6.51
Sophos Sweep v.2.59             419 of 419         100 %
Thunderbyte v.6.11              418 of 419         99,8 %
McAfee Scan 9.24 v 113          408 of 419         97,4 %
Central Point Anti-Virus v.2.0  401 of 419         95,7 %
F-Prot Professional v. 2.11a    394 of 419         94,0 %
Norton Anti-Virus v.3.0         3 of 419           0,7 %


TPE.Bosnia (221 infected EXE-files)

Product                        Infected files     Percentage
                               detected
Dr. Solomon's Anti-Virus       221 of 221         100 %
Toolkit v.6.51
Sophos Sweep v.2.59            221 of 221         100 %
Central Point Anti-Virus v.2.0 210 of 221         95,0 %
Thunderbyte v.6.11             59 of 221          26,7 %
McAfee Scan 9.24 v 113         42 of 221          19,0 %
Norton Anti-Virus v.3.0        39 of 221          17,7 %
F-Prot Professional v. 2.11a   35 of 221          15,8 %


Polymorphic virus detection totally

Product                        Infected files    Percentage
                               detected
Dr. Solomon's Anti-Virus       3815 of 3815      100 %
Toolkit v.6.51
Sophos Sweep v.2.59            3815 of 3815      100 %
Thunderbyte v.6.11             3650 of 3815      95,7 %
McAfee Scan 9.24 v 113         3620 of 3815      94,9 %
F-Prot Professional v. 2.11a   3531 of 3815      92,6 %
Norton Anti-Virus v.3.0        3174 of 3815      83,2 %
Central Point Anti-Virus v.2.0 2116 of 3815      55,5 %


Scanning speed test

Scanning speed test was evaluated in 486/33 PC with 8 Mbytes
of RAM and 607 kilobytes of conventional memory free. Size
of hard disk was 260 Mbytes and 80 Mbytes were used. No
checksum calculation or heuristic scanning was used.
Scanning speed includes memory scanning. Tests were carried
out in a clean machine with full scan.

Product                 DOS-version        Windows-version
Thunderbyte *           12 / 25 seconds    No Windows version
                                           available
Dr. Solomon's Anti-     27 seconds         40 seconds
Virus Toolkit
Norton Anti-Virus       40 seconds         40 seconds
F-Prot Professional     41 seconds         49 seconds
Sophos Sweep            110 seconds        No Windows version
                                           available
Central Point Anti-     118 seconds        No Windows version
Virus                                      available
McAfee Scan             126 seconds        No Windows version
                                           available

* Thunderbyte: If maximum compatibility option was on,
scanning speed was 25 seconds, otherwise 12 seconds

For further information contact:

Marko Helenius,           E-Mail: cshema@uta.fi
University of Tampere
P.O.BOX 607
SF - 33101 TAMPERE
FINLAND
