From: RADAI@HUJIVMS.BITNET (Y. Radai)
Newsgroups: comp.virus
Subject: Re: Which Package is Best? (PC)
Date: 6 Apr 92 14:26:00 GMT


  Wolfgang Stiller writes:
> >       However, when I answered Vesselin's question, my criterion in
> >comparing the two checkers for speed was to use the *fastest* mode
> >which each product provides.
>
>Come on now!  If we're comparing two products like this, it makes
>sense to compare the modes of operation that are most alike.  If in full
>check mode, Integrity Master reads and checks each and every byte on
>each and every file (or just executables).  This would seem the most
>"apples to apples" basis for comparison, since UT does basically the same
>thing.

"Come on now" yourself!  You know very well that the day after I wrote
the lines which you quote at the top, I published a clarification ex-
plaining that I did not mean "fastest" in an absolute sense, but the
fastest *practically secure* mode, and that I conceded that since I
would never be able to convince you that IM's quick update does not
meet that requirement while UT's does, I was withdrawing my former
claim concerning relative speed.  Moreover, you know very well that I
sent you a personal copy of that clarification and that you acknow-
ledged it!!  So why are you now, a week after my clarification, rever-
ting to what you know very well is not what I intended????

>        Will UT check ALL files (not just executables) like IM?   Will
>UT check source files (intended for programmers) along with executables?

Absolutely, if you request it.

>You don't seriously still maintain that UT's quick check is as secure as
>a full check?????   Consider if a single file is infected or corrupted,
>UT's quick check will miss this, while Integrity Master's full check
>will certainly detect it.

Just why do you decide that "UT's quick check will miss this"?  In the
great majority of infections, it won't miss it even on a single run.
And if it does, it will eventually be picked up because of the fact
that the quick check actually does a full check on a random 10% of the
viruses.  (Btw, I like Vesselin's suggestion of making this percentage
selectable by the user.)

> >I think what you're trying to describe is what I referred to as an
> >"ambiguity" virus in my paper.  It can't be detected by a checksummer
> >*alone*, but there are other measures which can be taken in this case,
> >and who says that the burden must be on a checksummer alone?
>
>I believe the fifth generation folks say this ;-)!  Their ads claim
>that once you buy UT you will not need to update or buy another product
>and be safe forever.  Or do I misunderstand?

First of all, I don't see that *you* say anywhere that *IM* cannot de-
tect such a virus, although what I wrote above is just as true for IM
as for UT.  Did you ever think of such a virus?
  Secondly, I state for the third time that I have not seen FGS's ads.
However, Vesselin has stated:
 >Oh, the guys from the marketing company did a pretty good job! They
 >wrote: "Only Untouchable guarantees 100% safe recovery of infected
 >files". Which is true - if the UT ever succeeds to remove a virus with
 >its generic algorithm, you can be sure that the file is 100% recovered
 >to its original state - since a checksum of the clean file is kept and
 >verified.
What you have claimed is that this might be interpreted to mean that
UT can be relied upon to provide recovery of all infected files.  Ok,
so please take your complaint to FGS, not to me.  I'm a satisfied
user of UT, not the defense attorney for FGS's advertising dept.,
though you seem to be trying to force me into that position.


  From an earlier reply of yours to Vesselin:
>IM has the quick check for a totally different reason than UT's.
>Actually IM calls it a "quick integrity update".  This does not do a
>sampling as UT does, but provides a fast way to do a full check of all
>files which are new and do a full check also of any files which show
>signs of having changed such time/date stamps or file size changes.

Since almost all viruses preserve the date and time, that means it
will not detect viruses which do not change the file size, i.e. those
(like Number of the Beast) which hide the increase behind the eof
mark, those (like ZeroHunt) which inhabit stack space, and those (not
yet in existence?) which compensate for an increase in size by com-
pressing the file.  (Of course, that's also true for stealth and
semi-stealth viruses which are active in memory, but that's common to
all programs if booting isn't done from a clean diskette.) Admittedly,
such viruses are not very common.  However, in contrast to UT's quick
check, which eventually performs a full check on all files, the above
types of viruses will *never* be detected as long as only IM-type
quick checks are performed.  That's the main reason why I wrote that I
consider UT's quick check to be more secure than IM's quick update.

                                     Y. Radai
                                     Hebrew Univ. of Jerusalem, Israel
                                     RADAI@HUJIVMS.BITNET
                                     RADAI@VMS.HUJI.AC.IL