================================================
File 6lLinux.TXT:
Detailed results of File and Macro Virus related 
on-demand scanner tests under Linux (SuSe edition):
===================================================
(Formatted with non-proportional font: Courier; 72 columns)

The following *5* products (versions) participated in aVTCs first
Linux test (for details of related AV producers: see A2SCNLS.txt):
 
    ================================================
    AVP     v: 3.0 build 135.2	    sig: Dec.05, 2000
    CMD     v: 4.60.0               sig: Dec.11, 2000
    FSE     v: 4.09 build 2351      sig: Dec.07, 2000
    RAV     v: 8.0.005 scaneng 8.3  sig: Dec.11, 2000
    SCN     v: 4.12.0 scaneng4.1.20 sig: Dec.06, 2000
    =================================================
 

The following tables summarize detection and identification quality
concerning FILE and MACRO viruses as well as selected FILE and MACRO
MALWARE, both in full "zoo" virus collection and for viral ITW testbed.
Additionally, test results are reported concerning detection of 
(4*10,000) viruses in a testbed with generations of 6 polymorphic file
viruses, as well as a subset of 10,706 viruses generated from VKIT
virus construction kit. Moreover, results for detection of viruses in
files compressed with 6 popular packing methods are also given. Finally,
special tests were performed concerning "false positive" virus detection
of selected files which were deliberately chosen from available CD-ROMs
and which were definitively clean of viruses, and the detection rate for
a selection of malware on several other platforms ("exotic") was also
determined. 

For discussion of results, see 6ASUMOV.TXT and 7EVAL.TXT. Results may
be influenced by problems experienced during tests; such problems are
documented in 8PROBLMS.TXT.

Index of tables:
---------------- 
   LIN.F1:  "FileVirus 1": Results of "full" Zoo test 
             for file viruses
   LIN.F2:  "FileVirus 2": Results of "In-The-Wild" test 
             for file viruses 
   LIN.FA:  "Polyfile-Test": Results of Polymorphic test
   LIN.FB:  "VKIT Test": Results of VKIT file virus test
   LIN.F3V: "Comparison of Detection Rate of Packed Viruses":
             Results of Detection Rate of ITW file viruses 
             packed with PKZIP, LHA, ARJ and RAR
   LIN.F3F: "Comparison of Detection Rate of Packed Viral Objects":
             Results of Detection Rate of objects infected with ITW 
             file viruses and packed with PKZIP, LHA, ARJ and RAR
   LIN.F3a: "PKZIP-Packed File Viruses": Results of Detection 
             of ITW File Viruses Packed wiith PKZIP
   LIN.F3b: "LHA-Packed File Viruses": Results of Detection 
             of ITW File Viruses Packed with LHA
   LIN.F3c: "ARJ-Packed File Viruses": Results of Detection 
             of ITW File Viruses Packed with ARJ
   LIN.F3d: "RAR-Packed File Viruses": Results of Detection 
             of ITW File Viruses Packed with RAR
   LIN.F3e: "WinRAR-Packed File Viruses": Results of Detection 
             of ITW File Viruses Packed with WinRAR
   LIN.F3f: "CAB-Packed File Viruses": Results of Detection 
             of ITW File Viruses Packed with CAB
   LIN.F4:  "False Positive" detection: Results of "full" Zoo test 
             for non-viral (clean) file samples detected 
             as "False positives" 
   LIN.F5   "File Malware": Results of "full" Zoo test 
             for File-related malware 
   LIN.M1:  "MacroVirus 1": Results of "full" test 
             for macro viruses 
   LIN.M2:  "MacroVirus 2": Results of "In-The-Wild" test 
             for macro viruses
   LIN.M3:  "Comparison of Detection Rate of Packed Viruses":
             Results of Detection Rate of ITW file viruses 
             packed with PKZIP, LHA, ARJ and RAR
   LIN.M3a: "PKZIP-Packed Macro Viruses": Results of Detection 
             of ITW macro Viruses Packed with PKZIP
   LIN.M3b: "LHA-Packed Macro Viruses": Results of Detection 
             of ITW macro Viruses Packed with LHA
   LIN.M3c: "ARJ-Packed Macro Viruses": Results of Detection 
             of ITW macro Viruses Packed with ARJ
   LIN.M3d: "RAR-Packed Macro Viruses": Results of Detection 
             of ITW macro Viruses Packed with RAR
   LIN.M3e: "WinRAR-Packed Macro Viruses": Results of Detection 
             of ITW macro Viruses Packed with WinRAR
   LIN.M3f: "CAB-Packed Macro Viruses": Results of Detection 
             of ITW macro Viruses Packed with CAB
   LIN.M4:  "False Positive" detection: Results of "full" zoo test 
             for non-viral (clean) macro objects detected 
             as "false positives"  
   LIN.M5:  "Macro-Malware": Results of "full" zoo test 
             for Macro-related malware
   LIN.S1:  "ScriptVirus 1": Results of "full" test 
             for script viruses (VBS, JS etc) 
   LIN.S2:  "ScriptVirus 2": Results of "In-The-Wild" test 
             for script viruses
   LIN.E1:  "Exotic" malware 


Table LIN.F1: "FileVirus 1": Results of "full" test 
               for file viruses:
===================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed   20564 100.0                         150703 100.0
----------------------------------------------------------
AVP       20539  99.9   595   2.9    13   0.1 150584  99.9 
CMD       20111  97.8    56   0.3    62   0.3 148730  98.7 
FSE       19967  97.1    77   0.4    73   0.4 148186  98.3 
RAV       19234  93.5   783   3.8   608   3.0 139515  92.6 
SCN       20501  99.7   275   1.3    20   0.1 150366  99.8 
-----------------------------------------------------------


Table LIN.F2: "FileVirus 2": Results of "In-The-Wild" 
               test for file viruses:
=====================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed      20 100.0                            409 100.0
----------------------------------------------------------
AVP          20 100.0     1   5.0     0   0.0    409 100.0 
CMD          20 100.0     0   0.0     0   0.0    409 100.0 
FSE          20 100.0     0   0.0     0   0.0    409 100.0 
RAV          20 100.0     3  15.0     2  10.0    404  98.8 
SCN          20 100.0     1   5.0     0   0.0    409 100.0  
-----------------------------------------------------------


Table LIN.FA: "Polyfile-Test": Results of detection test
              for polymorphic file viruses
========================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Maximum       6 100.0          %           %   60000 100.0 
----------------------------------------------------------
AVP           6 100.0     0   0.0     0   0.0  60000 100.0 
CMD           6 100.0     1  16.7     0   0.0  60000 100.0 
FSE           6 100.0     1  16.7     0   0.0  60000 100.0 
RAV           6 100.0     1  16.7     0   0.0  60000 100.0 
SCN           6 100.0     6 100.0     0   0.0  60000 100.0 
----------------------------------------------------------
Remark: For 6 polymorphic viruses (with Maltese Amoeba, 
        MTE.Encroacher.B, NATAS, TREMOR, One-Half and Tequila as
        in the previous test), 10,000 generations each were produced 
        with VTCs dynamic polymorphic generation and test engine. 
        For each virus, 100 directories including infected objects 
        with goat files of lengths ranging from 1 kByte to 100 kByte 
        were generated.


Table LIN.FB: "VKIT Test": Results of VKIT file virus test:
===========================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed   10706 100.0                         104640 100.0
----------------------------------------------------------
AVP       10706 100.0  1194  11.2     0   0.0 104640 100.0 
CMD       10706 100.0  5721  53.4     3   0.0 104636 100.0 
FSE       10706 100.0  1003   9.4     3   0.0 104636 100.0 
RAV       10706 100.0   221   2.1   178   1.7 104247  99.6 
SCN       10706 100.0    31   0.3     0   0.0 104640 100.0 
-----------------------------------------------------------
Remark: A testbed of 10,706 viruses generated with the VKIT
        virus generator (out of about 14,000 viruses which
        can be generated) was used to test detection quality.
        This test was separated from the "normal" file virus
        test as 1) there is no agreement between AV producers
        whether viruses from VKIT should be counted just as 1 or 
        as 14,000 different viruses (boasting number of detected 
        viruses to over 40,000), and 2) because of the large
        size of this special testbed. 


Table LIN.F3V:  "Comparison of Detection Rate of Packed Viruses":
                Results of Detection Rate of ITW file viruses 
                packed with PKZIP, LHA, ARJ, RAR, WinRAR and CAB:
=================================================================
                               This  includes        
                        Viruses detected per packer
-------------------------------------------------------------------------
          ZIP   %    LHA   %    ARJ   %    RAR   %   WRAR   %    CAB   % 
TestBed   20 100.0   20 100.0   20 100.0   20 100.0   20 100.0   20 100.0 
-------------------------------------------------------------------------
AVP       20 100.0   20 100.0   20 100.0   20 100.0   20 100.0   20 100.0 
CMD       20 100.0   20 100.0   20 100.0   20 100.0   20 100.0   20 100.0 
FSE       20 100.0   20 100.0   20 100.0    0   0.0    0   0.0    0   0.0 
RAV       20 100.0    0   0.0   20 100.0   20 100.0   20 100.0   20 100.0 
SCN       20 100.0   20 100.0   20 100.0   20 100.0   20 100.0   20 100.0 
-------------------------------------------------------------------------


Table LIN.F3F:  "Comparison of Detection Rate of Packed Viral Objects":
                Results of Detection Rate of objects infected with ITW file 
                viruses and packed with PKZIP, LHA, ARJ, RAR WinRAR and CAB
===========================================================================
                           This  includes        
                  Viral objects detected per packer
-------------------------------------------------------------------------------
          ZIP    %    LHA    %    ARJ    %    RAR    %    WRAR   %    CAB    %
TestBed   409 100.0   409 100.0   409 100.0   409 100.0   409 100.0   409 100.0 
-------------------------------------------------------------------------------
AVP       409 100.0   409 100.0   409 100.0   409 100.0   409 100.0   409 100.0 
CMD       409 100.0   409 100.0   409 100.0   409 100.0   409 100.0   409 100.0 
FSE       409 100.0   409 100.0   409 100.0     0   0.0     0   0.0     0   0.0 
RAV       404  98.8     0   0.0   404  98.8   402  98.3   404  98.8   404  98.8 
SCN       409 100.0   409 100.0   409 100.0   409 100.0   409 100.0   409 100.0 
-------------------------------------------------------------------------------


Table LIN.F3a: "PKZIP-Packed File Viruses": Results of Detection 
                of ITW File Viruses Packed with PKZIP:
================================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
-----------------------------------------------------------
Testbed      20 100.0                            409 100.0
----------------------------------------------------------
AVP          20 100.0     1   5.0     0   0.0    409 100.0 
CMD          20 100.0     0   0.0     0   0.0    409 100.0 
FSE          20 100.0     0   0.0     0   0.0    409 100.0 
RAV          20 100.0     3  15.0     2  10.0    404  98.8 
SCN          20 100.0     0   0.0     0   0.0    409 100.0 
-----------------------------------------------------------


Table LIN.F3b: "LHA-Packed File Viruses": Results of Detection 
	        of ITW File Viruses Packed with LHA:
==============================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
-----------------------------------------------------------
Testbed      20 100.0                            409 100.0
----------------------------------------------------------
AVP          20 100.0     1   5.0     0   0.0    409 100.0 
CMD          20 100.0     1   5.0     0   0.0    409 100.0 
FSE          20 100.0     0   0.0     0   0.0    409 100.0 
RAV           0   0.0     0   0.0     0   0.0      0   0.0 
SCN          20 100.0     0   0.0     0   0.0    409 100.0 
-----------------------------------------------------------


Table LIN.F3c: "ARJ-Packed File Viruses": Results of Detection
		of ITW File Viruses Packed with ARJ:
==============================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
-----------------------------------------------------------
Testbed      20 100.0                            409 100.0
----------------------------------------------------------
AVP          20 100.0     1   5.0     0   0.0    409 100.0 
CMD          20 100.0     0   0.0     0   0.0    409 100.0 
FSE          20 100.0     0   0.0     0   0.0    409 100.0 
RAV          20 100.0     3  15.0     2  10.0    404  98.8 
SCN          20 100.0     1   5.0     0   0.0    409 100.0 
-----------------------------------------------------------


Table LIN.F3d: "RAR-Packed File Viruses": Results of Detection
		of ITW File Viruses Packed with RAR:
==============================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
-----------------------------------------------------------
Testbed      20 100.0                            409 100.0
----------------------------------------------------------
AVP          20 100.0     1   5.0     0   0.0    409 100.0 
CMD          20 100.0     0   0.0     0   0.0    409 100.0 
FSE           0   0.0     0   0.0     0   0.0      0   0.0 
RAV          20 100.0     3  15.0     2  10.0    402  98.3 
SCN          20 100.0     0   0.0     0   0.0    409 100.0 
-----------------------------------------------------------


Table LIN.F3e: "WinRAR-Packed File Viruses": Results of Detection
		of ITW File Viruses Packed with WinRAR:
=================================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
-----------------------------------------------------------
Testbed      20 100.0                            409 100.0
----------------------------------------------------------
AVP          20 100.0     1   5.0     0   0.0    409 100.0 
CMD          20 100.0     0   0.0     0   0.0    409 100.0 
FSE           0   0.0     0   0.0     0   0.0      0   0.0 
RAV          20 100.0     3  15.0     2  10.0    404  98.8 
SCN          20 100.0     0   0.0     0   0.0    409 100.0 
-----------------------------------------------------------


Table LIN.F3f: "CAB-Packed File Viruses": Results of Detection
		of ITW File Viruses Packed with CAB:
==============================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
-----------------------------------------------------------
Testbed      20 100.0                            409 100.0
----------------------------------------------------------
AVP          20 100.0     1   5.0     0   0.0    409 100.0 
CMD          20 100.0     0   0.0     0   0.0    409 100.0 
FSE           0   0.0     0   0.0     0   0.0      0   0.0 
RAV          20 100.0     3  15.0     2  10.0    404  98.8 
SCN          20 100.0     0   0.0     0   0.0    409 100.0 
-----------------------------------------------------------


Table LIN.F4: "False Positive" detection: Results of "full" 
	       Zoo test for Non-viral (clean) samples 
	       detected as "false positives":
===========================================================
              False         This  includes        
              Virus      ---- unreliably ----     Files
Scanner       Alarm     identified   detected   detected
----------------------------------------------------------
Maximum      27 100.0                           664 100.0
----------------------------------------------------------
AVP           0   0.0     0   0.0     0   0.0      0   0.0 
CMD           0   0.0     0   0.0     0   0.0      0   0.0 
FSE           0   0.0     0   0.0     0   0.0      0   0.0 
RAV           0   0.0     0   0.0     0   0.0      0   0.0 
SCN           0   0.0     0   0.0     0   0.0      0   0.0 
----------------------------------------------------------
Remark: within 38 non-viral directories and totally 1851 non-
        viral objects, at least one sample in N directories
        was falsely detected (N = number in column 1) 


Table LIN.F5 "File Malware": Results of "full" Zoo 
              test for File-related malware:
==================================================
              File         This  includes        
             Malware     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed    6250 100.0                          12160 100.0
----------------------------------------------------------
AVP        6023  96.4   398   6.4    44   0.7  11676  96.0 
CMD        5872  94.0    62   1.0   125   2.0  11326  93.1 
FSE        5410  86.6    91   1.5   161   2.6  10445  85.9 
RAV        5036  80.6   215   3.4   192   3.1   9232  75.9 
SCN        5568  89.1    86   1.4    32   0.5  11071  91.0 
-----------------------------------------------------------


Table LIN.M1: "MacroVirus 1": Results of "full" 
               Zoo test for macro viruses:
===============================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed    6233 100.0                          19387 100.0
----------------------------------------------------------
AVP        6230 100.0    91   1.5     2   0.0  19381 100.0 
CMD        6233 100.0    72   1.2     0   0.0  19387 100.0 
FSE        6231 100.0     7   0.1     0   0.0  19371  99.9 
RAV        6208  99.6   309   5.0    10   0.2  19309  99.6 
SCN        6233 100.0    11   0.2     0   0.0  19387 100.0 
-----------------------------------------------------------


Table LIN.M2: "MacroVirus 2": Results of "In-The-Wild" 
               test for macro viruses:
=========================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed     147 100.0                           1347 100.0
----------------------------------------------------------
AVP         147 100.0     8   5.4     0   0.0   1347 100.0 
CMD         147 100.0     5   3.4     0   0.0   1347 100.0 
FSE         146  99.3     0   0.0     0   0.0   1343  99.7 
RAV         147 100.0    31  21.1     1   0.7   1346  99.9 
SCN         147 100.0     1   0.7     0   0.0   1347 100.0 
-----------------------------------------------------------


Table LIN.M3V: "Comparison of Detection Rate of Packed Viruses":
               Results of Detection Rate of ITW macro viruses 
               packed with PKZIP, LHA, ARJ, RAR, WinRAR and CAB:
================================================================
                           This  includes        
                        Viruses detected per packer
------------------------------------------------------------------------------
         ZIP    %    LHA    %    ARJ    %    RAR    %   WRAR    %    CAB    % 
------------------------------------------------------------------------------
Testbed  147 100.0   147 100.0   147 100.0   147 100.0   147 100.0   147 100.0 
------------------------------------------------------------------------------
AVP      147 100.0   147 100.0   147 100.0   147 100.0   147 100.0   147 100.0 
CMD      147 100.0   147 100.0   147 100.0   147 100.0   147 100.0   147 100.0 
FSE      146  99.3   146  99.3   146  99.3     0   0.0     0   0.0     0   0.0 
RAV      147 100.0     0   0.0   147 100.0   147 100.0   146  99.3   147 100.0 
SCN      147 100.0   147 100.0   147 100.0   147 100.0   147 100.0   147 100.0 
------------------------------------------------------------------------------


Table LIN.M3F: "Comparison of Detection Rate of Packed Viral Objects":
                Results of Detection Rate of objects infected with ITW 
                file viruses and with PKZIP, LHA, ARJ, RAR, WinRAR, CAB
=======================================================================
                           This  includes        
                  Viral objects detected per packer
-------------------------------------------------------------------------------
          ZIP    %    LHA    %    ARJ    %    RAR    %   WRAR    %    CAB    %
------------------------------------------------------------------------------- 
Testbed  1347 100.0  1347 100.0  1347 100.0  1347 100.0  1347 100.0  1347 100.0 
-------------------------------------------------------------------------------
AVP      1347 100.0  1347 100.0  1347 100.0  1347 100.0  1347 100.0  1269  94.2 
CMD      1347 100.0  1347 100.0  1347 100.0  1347 100.0  1347 100.0  1347 100.0 
FSE      1343  99.7  1343  99.7  1343  99.7     0   0.0     0   0.0     0   0.0 
RAV      1346  99.9     0   0.0  1346  99.9  1342  99.6  1246  92.5  1346  99.9 
SCN      1347 100.0  1347 100.0  1347 100.0  1347 100.0  1347 100.0  1347 100.0 
-------------------------------------------------------------------------------


Table LIN.M3a: "PKZIP-Packed Macro Viruses": Results of Detection
                of ITW Macro Viruses Packed with PKZIP:
=================================================================
                            This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed     147 100.0                           1347 100.0
----------------------------------------------------------
AVP         147 100.0     8   5.4     0   0.0   1347 100.0 
CMD         147 100.0     0   0.0     0   0.0   1347 100.0 
FSE         146  99.3     0   0.0     0   0.0   1343  99.7 
RAV         147 100.0    31  21.1     1   0.7   1346  99.9 
SCN         147 100.0     6   4.1     0   0.0   1347 100.0 
----------------------------------------------------------


Table LIN.M3b: "LHA-Packed Macro Viruses": Results of Detection
                of ITW Macro Viruses Packed with LHA:
===============================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed     147 100.0                           1347 100.0
----------------------------------------------------------
AVP         147 100.0     8   5.4     0   0.0   1347 100.0 
CMD         147 100.0     0   0.0     0   0.0   1347 100.0 
FSE         146  99.3     0   0.0     0   0.0   1343  99.7 
RAV           0   0.0     0   0.0     0   0.0      0   0.0 
SCN         147 100.0     6   4.1     0   0.0   1347 100.0 
----------------------------------------------------------


Table LIN.M3c: "ARJ-Packed Macro Viruses": Results of Detection
                of ITW Macro Viruses Packed with ARJ:
===============================================================
                            This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed     147 100.0                           1347 100.0
----------------------------------------------------------
AVP         147 100.0     8   5.4     0   0.0   1347 100.0 
CMD         147 100.0     0   0.0     0   0.0   1347 100.0 
FSE         146  99.3     0   0.0     0   0.0   1343  99.7 
RAV         147 100.0    31  21.1     1   0.7   1346  99.9 
SCN         147 100.0     6   4.1     0   0.0   1347 100.0 
-----------------------------------------------------------


Table LIN.M3d: "RAR-Packed Macro Viruses": Results of Detection
                of ITW Macro Viruses Packed with RAR:
===============================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed     147 100.0                           1347 100.0
----------------------------------------------------------
AVP         147 100.0     8   5.4     0   0.0   1347 100.0 
CMD         147 100.0     0   0.0     0   0.0   1347 100.0 
FSE           0   0.0     0   0.0     0   0.0      0   0.0 
RAV         147 100.0    29  19.7     5   3.4   1342  99.6 
SCN         147 100.0     6   4.1     0   0.0   1347 100.0 
----------------------------------------------------------


Table LIN.M3e: "WinRAR-Packed Macro Viruses": Results of Detection
                of ITW Macro Viruses Packed with WinRAR:
==================================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed     147 100.0                           1347 100.0
----------------------------------------------------------
AVP         147 100.0     8   5.4     0   0.0   1347 100.0 
CMD         147 100.0     0   0.0     0   0.0   1347 100.0 
FSE           0   0.0     0   0.0     0   0.0      0   0.0 
RAV         146  99.3    29  19.7     3   2.0   1246  92.5 
SCN         147 100.0     6   4.1     0   0.0   1347 100.0 
----------------------------------------------------------


Table LIN.M3f: "CAB-Packed Macro Viruses": Results of Detection
                of ITW Macro Viruses Packed with CAB:
===============================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed      80 100.0                            672 100.0
----------------------------------------------------------
AVP         147 100.0     7   4.8     7   4.8   1269  94.2 
CMD         147 100.0     0   0.0     0   0.0   1347 100.0 
FSE           0   0.0     0   0.0     0   0.0      0   0.0 
RAV         147 100.0    31  21.1     1   0.7   1346  99.9 
SCN         147 100.0     6   4.1     0   0.0   1347 100.0 
----------------------------------------------------------


Table LIN.M4: "False Positive" macro virus detection: Results
               of "full" zoo test for non-viral (clean) 
               macro objects detected as "false positives":
=============================================================
              False         This  includes        
              Virus      ---- unreliably ----     Files
Scanner       Alarm     identified   detected   detected
----------------------------------------------------------
Maximum      26 100.0                            329 100.0
----------------------------------------------------------
AVP           0   0.0     0   0.0     0   0.0      0   0.0 
CMD           1   3.8     0   0.0     1   3.8      2   0.6 
FSE           1   3.8     0   0.0     1   3.8      2   0.6 
RAV           0   0.0     0   0.0     0   0.0      0   0.0 
SCN           0   0.0     0   0.0     0   0.0      0   0.0 
-----------------------------------------------------------
Remark: within 26 non-viral directories and totally 329 non-
        viral objects, at least one sample in N directories
        was falsely detected (N = number in column 1) 


Table LIN.M5: "Macro-Malware": Results of "full" 
               test for Macro-related malware:
================================================
              Macro         This  includes        
             Malware     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed     403 100.0                            627 100.0
----------------------------------------------------------
AVP         400  99.3     0   0.0     0   0.0    624  99.5 
CMD         402  99.8     6   1.5     0   0.0    621  99.0 
FSE         402  99.8     2   0.5     0   0.0    621  99.0 
RAV         391  97.0    23   5.7     5   1.2    604  96.3 
SCN         402  99.8     0   0.0     0   0.0    626  99.8 
-----------------------------------------------------------


Table LIN.S1: "ScriptVirus 1": Results of "full"
               Zoo test for script viruses:
=================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed     477 100.0                            904 100.0
----------------------------------------------------------
AVP         476  99.8    32   6.7     1   0.2    901  99.7 
CMD         462  96.9     1   0.2    12   2.5    848  93.8 
FSE         462  96.9     9   1.9    17   3.6    845  93.5 
RAV         405  84.9    46   9.6    28   5.9    697  77.1 
SCN         476  99.8     3   0.6     2   0.4    896  99.1 
-----------------------------------------------------------


Table LIN.M2: "ScriptVirus 2": Results of "In-The-Wild" 
               test for script viruses:
=======================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed      16 100.0                            133 100.0
----------------------------------------------------------
AVP          16 100.0     2  12.5     0   0.0    133 100.0 
CMD          16 100.0     0   0.0     4  25.0    125  94.0 
FSE          16 100.0     0   0.0     6  37.5    125  94.0 
RAV          16 100.0     4  25.0     5  31.3    115  86.5 
SCN          16 100.0     1   6.3     0   0.0    133 100.0 
----------------------------------------------------------


Table LIN.E1: "Exotic Malware": Results of special
               test for exotic viruses:
==================================================
                           This  includes        
            Viruses     ---- unreliably ----     Files
Scanner     detected    identified   detected   detected
----------------------------------------------------------
Testbed     115 100.0                            274 100.0
----------------------------------------------------------
AVP         104  90.4     3   2.6     0   0.0    252  92.0 
CMD          77  67.0     1   0.9     5   4.3    130  47.4 
FSE          17  14.8     1   0.9     3   2.6     59  21.5 
RAV          85  73.9     3   2.6     6   5.2    184  67.2 
SCN          62  53.9     1   0.9     3   2.6    185  67.5 
----------------------------------------------------------

