the quote was from a copy of the regulations I found at:

http://www.epic.org/crypto/export_controls/interim_regs_12_96.html

>           c.3. ``Software'' designed or modified to protect against malicious
>       computer damage, e.g., viruses;

The regulations are very hard to read; this is part of a commidity
classification known as "5D002", for "information security software".

      5D002  Information Security ``Software''
       
      License Requirements
      Reason for Control: NS, AT, EI
       Control(s) Country Chart
       
	  NS applies to entire entry--NS Column 1
       
          AT applies to entire entry--AT Column 1
       
          EI controls apply to encryption software transferred from the U.S.
      Munitions List to the Commerce Control List consistent with E.O. 13026
      of November 15, 1996 (61 FR 58767) and pursuant to the Presidential
      Memorandum of that date. Refer to Sec. 742.15 of the EAR.

As best I can tell, "EI" stands for "encryption items".  "NS" I
presume to be "National Security", and "AT" to be "Anti-Terrorism".

This may mean that anti-virus software is only subject to "NS" and
"AT" controls which I believe are somewhat weaker than "EI" controls.
 
					- Bill