Symantec saves the day.

Hello all at wilders',

I really had to make up this little report. I fixed a friends computer today, and had a very interesting experience. Too bad I couldn't take any logs or screenshots with me, so I'm sorry about that.

Case:
Heavy infected system, bootup problems ect. ect.

Solution:
First solution: McAfee, found several worms and trojans (Netsky, Mytob and SDbot).
Second solution: F-Secure, found one trojan (SDbot) McAfee left behind.
Thirt solution: Symantec found 218 (!) infected files the left behind. A couple of them were in the Windows folder, others in his Mozilla Mail archive.

Conclusion:
Was very suprised by this. And it made me think of the quality of the other two products, 218 is a lot. And it were all quite old variants of Netsky, Mytob and some SDbots.
So at the end I've to admit, Symantec really has good detection, and for some reason also good unpacking (considering the viruses it found in the mail archive). I've submitted the missed samples to both F-Secure and McAfee.

 

Thanks for the info on your experience. Which version of Symantec did you use?

 

I used the following programs:

• McAfee VirusScan Enterprise v8.0i
• F-Secure Anti-Virus Client Security v6.01.11441
• Symantec Antivirus Corporate Edition v10.0.2.2000

All with the latest updates ofcource

 

Many AV programs don't scan mail archives by default during on demand or scheduled scans. They rely on the fact any infected mail will be caught in real time as it's sent/received. This would explain why McAfee and F-Secure missed viruses in the Mozilla mail archive.

I regularly use Kaspersky (same engine as F-Secure), McAfee and BitDefender to clean infected machines - they all catch some that the others miss. You simply can't rely on a single product to 100% clean a badly infected machine.

Ned

 

It is good if you try NOD32 also in the next time.