Virus companies are they really doing enougth

[The PIT]

A fifth out break of virus has arrived on our network as I predicted.

Mcafee identifies the virus's as polybotI!.hosts.

Sadly the instructions on the web site are totally wrong. None of the reg entries are present. So you conclude the virus has been succesfully removed. Working in safe mode when required.

You reboot and it's back. You check whats running and you can't see anything silly. You check the registry and you see an entry called sysconf.exe.

A quick search brings you too Sophos and they call it Agobot-fp

Two registry entires need removing from the run section.
Referances to 2nd file show no entries in this section.

You delete these make sure the admin has a password and reboot. It's back. Back to safe mode.

Regedit again and you find both files mentioned elsewhere. You remove the entries and delete sysconf.exe from the hard drive.

Reboot it's gone. However Mcafee never detects the file sysconf.exe. It cleans the host file but thats it.

Symantec have another solution for the same virus. I didn't bother looking at this as no doubt Panda and others have yet more entries.

I find this very poor by the virus companies do they really know what they're doing.

Forgot to mention the people monitoring the network have noticed that the virus isn't always using the ports claimed by symantec.

[Tjalfe]

I agree.. the few virii I had to battle here were identified fine by mcafee and norton, but they did little to actually get rid of them

How about changing your network to not allow any sort of executable files being transferred through email, with the exception of people who asks for this feature.. would be a good start

[The PIT]

Doesn't spread by email though.
IRC is one way.
The old SQL hole.
The old blaster hole.
Weak admin passwords.
Plus a few others and others the virus companies don't know about.

[Tjalfe]

I still think that blocking all executables in emails would be a good start.. and something all ISP's should do, untill a user specfically requests to have access to such .. This would at least stop some outbreaks

[BarryS]

What do the AntiVirus companies use to protect themselves from new virii?

[Ribbit]

Their competitors' products?

[UtwigMU]

I read some speculation that AV companies don't want to release a product that would relly work (like remember executable files and running processes) and prevent altering or new running processes from being installed, because the yearly subscription for definitions is their cash cow.

[KvHagedorn]

Originally posted by BarryS
What do the AntiVirus companies use to protect themselves from new virii?

They just write the cure when they write the virus.

What a scam.

[Rob(QG)]

What I don't get is that older versions of McAfee used to monitor for executable files being created, renamed or changed - and would throw up a blue screen forcing you to decide whether to allow or disallow the action. Real pain if you were developing, but useful on the whole, I would have thought.

Not quite sure when or why that kind of protection was removed, or why similar protection can't be applied to areas of the registry.

[The PIT]

Problem seems to be admin accounts with no passwords. Bar anti virus companies not doing there job. I had one user today who said I've been all over Mcafee web site and the instructions don't work.
Apparently the symantec removal doesn't work either. Poor show chaps.

[The PIT]

One of the departments sent the virus to Mcafee who issued a temprary patch. However it seems then patch removes the admin password so we're back with the same problem. If thats true of course. I'm on Holiday.

[DGhost]

An interesting read.