Anyone know why Anti Virus software cannot detect Nachi

[The PIT]

I've seen this loads of times at work.

Sophos failed
Mcafee 7.0 failed
Nortons Anti Virus 2002/03 failed

If you're luckly they'll squark when you run stinger and it tries to delete the files concerned but even then most will sit quietly and say nothing.

Is this because the worm is launched before the virus checker starts up or what. We did query it with Sophos but got a feeble response of ensure you're using the latets engine and updates which we were.

[az]

Maybe it's because you're using crappy anti virus software

AZ

[Guru]

Originally posted by az
Maybe it's because you're using crappy anti virus software

AZ

Exactly what I was thinking!

[Helevitia]

Quote form Symantec:

Norton Internet Security/Norton Internet Security Professional
On August 20, 2003, Symantec released IDS signatures via LiveUpdate to detect W32.Welchia.Worm activity.

Symantec Client Security
On August 20, 2003, Symantec released IDS signatures via LiveUpdate to detect W32.Welchia.Worm activity.

[SteveC]

Good old AVG gets it everytime

[The PIT]

Originally posted by Helevitia
Quote form Symantec:

Sadly Nortons doesn't detect if it's running from the start. It'll catch it if you do a scan as will the rest but not by using the auto protect features of these virus programmes.

Stevec I presume you're saying it catches it during a scan. To clean it we use stinger and that always finds it.

[Paulr]

It doesn't?
Better tell the Norton Corporate 7.6 we're running at work and the Norton 2004 I'm running at home.
Both systems which have stopped the Nachi virus dead in its tracks as soon as it was present on the system.

[The PIT]

Originally posted by Paulr
It doesn't?
Better tell the Norton Corporate 7.6 we're running at work and the Norton 2004 I'm running at home.
Both systems which have stopped the Nachi virus dead in its tracks as soon as it was present on the system.

Can't comment on 2004 or 7.6 as I haven't seen it on campus. Just had someone complaining that F-Secure anti virus didn't detect the virus this morning while I was doing the nachi removing rounds.