From: 72571.3352@CompuServe.COM (Wolfgang Stiller)
Newsgroups: comp.virus
Subject: Re: Which Package is Best? (PC)
Date: 10 Apr 92 21:45:53 GMT


   Y. Radai <RADAI@HUJIVMS.BITNET> writes:

 > "Come on now" yourself!  You know very well that the day after I
 > wrote the lines which you quote at the top, I published a
 > clarification explaining that I did not mean "fastest" in an
 > absolute sense, but the fastest *practically secure* mode, and
 > that I conceded that since I would never be able to convince you
 > that IM's quick update does not meet that requirement while UT's
 > does, I was withdrawing my former claim concerning relative speed.

You say you retracted your claim yet you went on to defend it again.
That is why I made my comments.  If, in fact, you no longer make
this claim then let's please drop this issue.

 > Moreover, you know very well that I sent you a personal copy of
 > that clarification and that you acknowledged it!!  So why are
 > you now, a week after my clarification, reverting to what you
 > know very well is not what I intended????

Please!  Based on your personal note to me, I waited for your
second posting before I replied and was disappointed to hear you
justifying your comparison again.   If you say you withdraw your
claim, let's let this issue rest.

Please read my remarks carefully.  Strange is it may seem I think
you and I agree more than we disagree <g>.   I was not
"reverting" at all.   From my perspective, there's only one point
where you and disagree and that seems to be my contention that
to compare two products it's best to compare the functions that
are most similar (in the case of Integrity Master and Untouchable,
it's the full check modes).    How about we agree to disagree on
this point?

 > >You don't seriously still maintain that UT's quick check is as secure
as
 > >a full check?????   Consider if a single file is infected or corrupted,
 > >UT's quick check will miss this, while Integrity Master's full check
 > >will certainly detect it.

 > Just why do you decide that "UT's quick check will miss this"?  In
 > the great majority of infections, it won't miss it even on a
 > single run. And if it does, it will eventually be picked up
 > because of the fact that the quick check actually does a full
 > check on a random 10% of the viruses.  (Btw, I like Vesselin's
 > suggestion of making this percentage selectable by the user.)

I thought you said UT will check 10% of the files on a quick
check.  (Are you saying now it checks for you 10% of the viruses
only!?)  If it checks only 1 of 10 files, the odds are a quick
check will miss it on any particular run.

 > However, Vesselin has stated:
 >  >Oh, the guys from the marketing company did a pretty good job! They
 >  >wrote: "Only Untouchable guarantees 100% safe recovery of infected
 >  >files". Which is true - if the UT ever succeeds to remove a virus with
 >  >its generic algorithm, you can be sure that the file is 100% recovered
 >  >to its original state - since a checksum of the clean file is kept and
 >  >verified.
 > What you have claimed is that this might be interpreted to mean that
 > UT can be relied upon to provide recovery of all infected files.  Ok,
 > so please take your complaint to FGS, not to me.  I'm a satisfied
 > user of UT, not the defense attorney for FGS's advertising dept.,
 > though you seem to be trying to force me into that position.

My complaint was not (and still isn't) directed at you.  Please
understand that when I say something to you, I am not necessarily
disagreeing with you or complaining to you.  I don't expect you
to defend FGS's advertising, but, as I have stated before, I
expect you to realize that their claims can causes disastrous
results for the unsuspecting user.  I know this has nothing to
do with the technical merit of their product, but I believe our
responsibilities need to be broader than simply technical
evaluation.

You mentioned that many viruses preserve time and date stamps and
other reasons why you prefer UT's quick check to IM's "quick
integrity update".   The two can not be compared.   IM's "quick
integrity update" is intended as a quick way to bring integrity
data up to date and to check for normal file changes (if the user
is using IM for change tracking).

I expect you and I will have to agree to disagree on your
comparison;  my view will remain that the only fair comparison is
to compare full check modes of both products. After saying all
this, let me repeat that I think Untouchable is a fine product, I
simply have a tiny bias to Integrity Master ;-).

Regards, Wolfgang                                 Wolfgang Stiller
                                                  Stiller Research
                                                  2625 Ridgeway St.
                                                  Tallahassee, FL 32310
                                                  U.S.A.