Hi Kurt!
04 Jan 97, letter Kurt Wismer to Dmitry Mostovoy:
 KW> i really don't agree... the more viruses a scanner detects, the fewer
 KW> viruses can get past that particular security measure and thus the
 KW> fewer
 KW> viruses that need to be cleaned up after they've infected the system...
 KW> the single most important feature of a scanner is the ability to detect
 KW> viruses... the more it detects, the better it is...
    No! I'll try to explain my point of view. For example, lets imagine 
anti-virus scanner for 10.000 viruses which is not supported during last 
year. I.e. it knows 10.000 old viruses and do not know modern ones. Is it a 
good scanner or not? And another scanner for 5.000 viruses, but regulary 
supported. What scanner is more useful? The first one or the second one? But 
you may ask if the first scanner has 10.000 viruses and not supported during 
only one month and the other has 9.000, but virus database is updated every 
day. What scanner is better in this case? The situation is not so clear...
    Of course, scanner SHOULD have a big database. But it is not the only 
criterion of scanner choice. It is more complex problem for analysis. For 
example if you live in Russia, Ukrainia or somewhere else, where new viruses 
appear every day or faster, the first scanner in the previous paragraph will 
not help you. If you have files exchange with the regions, where new viruses 
appear regulary you should use local developed and supported scanner as the 
first scanner even it does not have a big database. And the scanner with a 
big virus base may be used as a second defence line.
                                    With best regards,
                                            Dmitry Mostovoy
--- GoldED 2.50+
---------------