With reference to a press release from McAfee Associates about some potential "cheating mode" built-into antivirus products of Dr Solomon's, may I duely inform the community that VTC tests aim at finding the maximum detection rates for each scanner. To achive this, we use switches and options in those positions designed and implemented to reach such results. If such options or switches are not suitably documented (which VTC advises AV producers to publish as a means of duely supporting their users), we receive or request related information from manufacturers.

In those VTC tests documented on our WWW and FTP sites ("1994-07" and "1997-02"), the related options have been described in the "list of scanners tested" (see resp. index in test report).

Concerning tests of Dr Solomon's AV products, VTC tests have used the switch "/VID" which prevents the scanner from automatically switching into heuristic mode and forces it to always identify the viruses it detects. We also use the "/ANALYZE" switch which turns on the heuristic analyser of the product from the very beginning. Therefore, the problem of "cheating" (meaning a programmed decision of an AV product to swich into a heuristic mode to enforce detection of more viruses) has NEVER applied to VTC tests.

Finally, it has been argued that such "cheating" is deliberately done by AV producers to influence time behaviour of a product during test. VTC has always argued that the scanning speed of a scanner should be tested on a clean system, not on a virus collection.

Klaus Brunnstein, University of Hamburg (VTC), April 9, 1997