Re: Extracting signature snippets from AV databases

On Wednesday 10 May 2006 01:02 pm, Bill Stout wrote:
> What I'm trying to figure out is how to 'smoke test' new builds, and to
> ethically and fully demonstrate (to the CEO, to outsiders) that the
> protection works.  We're in alpha test, and beta is approaching fast.

Easily done, and I have done this many times.  Take the Results from the fore 
mentioned independent test organizations, then run a scan with SpyCAR and 
EICAR, showing that they were detected.  Then File the independent tests, and 
your logs, this will show any C level executive, first you did due diligence 
researching existing products, second you chose a product that withstood 
independent review, and finally the detection of the test files on your image 
shows it properly installed and functioning.  This also impresses auditors, 
should you be externally audited.

-- 
Kenneth L. Bechtel, II
Team Anti-Virus
Phone - 717-579-9083                      | WildList Reporter
P.O. Box 635, Palmyra, PA 17078           | Founding member AVIEN
E-mail - [email protected]      | Member AVAR
I can't be an impostor - I don't know what I'm doing!
PGP Footprint: 969E 2A27 3042 EE52 AEFB  6FF0 2711 9467 D38C 5C0F