> "Subsequent discussions indicated that they were simply
> acquired from darkside web sites or the tester's own mailbox ..."
>
> If the latter,

This is from Dirk Morris's response to some of the comments on the Untangle
blog.
"While this set is small in the number of unique samples it is large in that
it all the viruses I received for years(...)If a virus catches 99% of the
600,000, but only half of the 18 samples I get by the thousands in my inbox
- what good is the engine? "

> that makes the process circular

Indeed. It's a classic example of how to skew (deliberately or not) a test
result (www.softpanorama.org/Malware/Reprints/virus_reviews.htm)

> The University of Utah had a comparative study, testing
> against Office macro viruses, using a much larger sample, and
> in that test ClamXAV performed notably badly:

ClamAV (and therefore presumably ClamXav) has improved its macro virus
detection over the years, but not disinfection, as Edward pointed out.

--
David Harley
http://www.smallblue-greenworld.co.uk

[ reply ]