Virus not detected by Nod32 - rather concerned!

I have just fixed, after many hours of ploughing through the web, a virus that prevents you from using any web browser (IE7, FireFox) to go to anti virus sites. All other sites were accessible. The virus even blocked sites that offered assistance to removing viruses.

The infected file was mswsock.dll which is part of the Windows Socket API that interfaces software to the internet. I solved the problem by copying the file from a working OS into the \windows\system32 and \windows\SoftwareDistribution folders.

What surprises me is that Nod32 doesn't pick up on this type of virus. Is this something new?

I would have thought Nod32 would flag a change to this kind of file.

 

In fact eset slow lately in updates, I sent new variants of bagle and gromozon and have never been updated

@Marcos
why?

 

Frankly, I was wondering why we haven't received a Bagle sample from you for quite a long time as you used to submit them quite frequently. Could you resend undetected variants to samples[at]eset.com with "Bagle" in the subject as usual and PM me when done so that I can check if they have actually arrived?

 

ok

 

i also send ~removed virustotal scan link per policy....Bubba~ to samples@eset.com two days ago. After 5 virus def updates nothing happend.. it is a pity.
Maybe I should use Microsoft Antivir because it was one of the first they detect the virus.

 

Hello,

ESET can be the first, who will detect other virus.

 

Yeah maybe but version 3271 still not detect the zlob variant...
a little bit curious...

 

Zlob has got many new variants every day and source of them is known - It's "porn codec". Don't visit these sites, won't have Zlob.

 

ok my fault, I don't know that nod32 don't includes variants from such sites.
thx for the tip
don't use the internet, won't have a virus.

 

don't use the internet, won't have a virus
There are many new variants of zlob, vundo, bagle that nod32 do not detect.
nod32 would not admit that and update it´s detection capabilities, but advice not using dangerous sites

 

Not a BAGLE! nod now identifies all variations. trusted

crafty facts, use Sandboxie and continue to use the Internet

 

yeah maybe the best way to use Nod32 because after 5 days 55% of the scanner detect this cool file
http://info.prevx.com/aboutprogramtext.asp?PX5=FDF5809D00EA958D0063019FAC841400729BBB51
except nod32 because it comes from a porn site...
too bad...

 

I could show you an example of spammed dropper from a fake email from Microsoft where NOD32 was one of 3 AVs to detect it and it remained so even after 2 days. I won't go into details as comparing products or bashing is not allowed in this forum.