Security Solutions: Get more from antivirus

Anti Virus software and updates would be almost unnecessary if people properly secured their systems in the first place. It is the action of the virus that should be prevented rather than just looking at signatures. I have develoed a 10 stage plan for virus protection that has kept me virus free since before the dawn of macro viruses. I co-authored an application which prevented their action which stopped the first macro virus winword concept despite never having seen it before.

If you are interested in this 10 point plan I will post it next week.

Regards

Andy Rice

Ladies and Gentlemen:

This is my recent (yesterday) experience with submitting a virus sample to McAfee and Symantec:

At 1:30 pm I received an e-mail at work claiming to be an update from Microsoft with an attachment named "pack17.exe". I have Symantec Anti-Virus Corporate Edition at work and McAfee Online at home, so I am familiar with both. I searched both sites and the web, but got 0 matches for pack17.exe.

I quarantined the file, but found that since I am a managed client, I could not directly send the file to Symantec. A search of their website found a way to download a tool, Sacret.exe, to submit a file. This utility failed with the error, "Cannot connect to SAV server" several times before I gave up.

I switched over to McAfee, but since I was not running their product on my work computer, I first tried forwarding them the e-mail I got, with a description of the attachment instead of the actual attachment included. The reply I got pointed me to their definition for the Dumaru worm. After reading that page, I replied back disagreeing with them, and asked how I could submit a sample to them.

McAfee sent me instructions which allowed me to submit "pack17.exe" to them. The results came back at 2:52 pm as a newly discovered worm which they called w32/swen@mm, and they sent me a DAT file for it. Since it is so new, the definitions for it had not been posted yet.

I gave this information to my system administrator and when he checked, SAV was aware of it. By that time he was able to download an extra file from them as well.

What a pain that experience was.

Posted for Karen Hamelinck

I believe ones true appraisal of the value of antivirus protection is likened to car insurance. Most people purchase car insurance based on price. They buy it, forget about it, and never appreciate its value until they are involved in an accident. Their opinion of their insurance after the accident depends on how the insurance company handles the claim. I never gave much thought to my antivirus protection; however, I did realize you get what you pay for. So I paid for the extended service from Symantec (on all of my computers). Nearly 3 yrs. would pass before I would know the quality and value of my vendor's antivirus protect after a visit from the wormblast. Immediate service (online) with quick and easy repair software includeing which Microsoft patches I needed and the procedure broken into steps, told me my vendor understood the value of antivirus protection even when I didn't. A few dollars of prevention will always outweigh hundreds to thousands of $$ for reparation. These days, it is not a question of "if?" but "when?" you will be infected by some virus or another. Don't be caught without protection.

Antivirus software should move towards policy based virus scanning than signature based virus scanning or try a mixure of both. The time delay between Virus release and update release can never be zero in signatue based AV.

Another area to give focus is on the manageblity side.Remember is 'security is not Plug and play'.