Desktop AV vs. Virus Total

Received email from unknown party with .doc attachment (“...here’s the resume you requested....blah blah”).
Of course I assume a macro virus or the like, so, for giggles, I scan with Nod32 AV. Nothing detected.
Upload to Virus Total, and Nod32 (and a couple others) identified it as a virus?
(Same virus sig database as on my desktop)?

 

Did you enable document protection integration in ESET?

 

It was off (by default).
Does it need to be on? i.e: Would not a manual scan of the file detect malware?

 

I usually enabled integration. I don't know why it wasn't detected.

 

Document protection has no effect on detection. It's better to keep it disabled to prevent a bug in MS Office from manifesting (performance issues that occur even with an empty plug-in registered in the system). Send the file to samples[at]eset.com with a description of the issue.

 

https://www.virustotal.com/en/faq/

 

Interesting, thanks.

 

You're welcome.

 

Well, I'm not perfect, and I can still make mistakes. That's why I'm still using a desktop AV.

 

Please submit the file to ESET as instructed in my previous message. A trial version of ESET is exactly same as the full version in terms of detection and protection.

 

File sent.
Local is not trial. (ESET on my boxes for years.)
Note ~48 hrs later it is now flagged by Nod32 local as well as many more vendors on VirusTotal.

 

unknown files from unknown parties -> drop dev.nul (recycle bin), no waste of time and thoughts.