My clients PC just got infected with W32.Gaobot.AFJ (symantec def). The infection was not detected via TDS-3, only after I updated the defs of Norton (manual update through a website from another pc since the hosts file of this one was hosed). Come on guys, you made me look bad. I recommended this security suite and here they got infected. It's a server it can't afford an infection. Yes the execution protection is Running (and was running at the time of the infection). (oh yeah TDS3 was dead, killed by the strain, but when I've ranned TDS3 with the latest defs it did not pickup any Remnants of the strain in the registry even though by CTRL-A I could see the entries the strain has left behind...tsk tsk. ) Lost my faith Beaten by Norton. Now I installed BoClean on that PC for extra protection, I guess I can no longer trust one security suite to do the job. P.S. The files are in Norton 8 Quarantine, so I don't know how to get them out. Each time I try to export them all I get is 1kb tabdelimated text file. So if you guys want the sample (it's called win32.exe and it gets deposited in root/system32/) then tell me how to get the darn file out of the Norton Pro 8.0 quarantine and I will do so (and send the sample to you). P.S.S The TDS-3 got updated right after I restarted it, so the defs were/are up to date and it still can't see it. P.S.S.S BoClean installed on the server is the owners liceneased copy. It was his own personal copy which I adviced him to purchase for his own laptop. The reason I advice for BoClean instead of TDS-3 is because he wanted a non intrusive, set it and forget it low resource AT system. TDS-3 being a great system but needing actuall user interaction was not the option. So I told him that the server needs TDS-3 because it has a great overall system scanner (as new files arrive I can perform a system scan of all the files) whereupon his laptop doesn't need that. So in order to save the server and all of his files he sacrificed his copy of BoClean to the server....now you know why I don't want him to purchase any more Security software since he allready spent a lot thus Process Guard is not an option. ( it would just make me look like a used car salesman). So for Nancy or Kevin don't worry this is a copy used on only 1 pc (as far as I know). And it's not a large coporation it's an lab so it's not really a business.