Re: NORTON Firewall doesn't detect TROJAN, !!WARNING TROJAN ATTACHED!!

From: FromTheRafters (!0000@nomad.fake)
Date: 12/21/02 

From: "FromTheRafters" <!0000@nomad.fake>
Date: Fri, 20 Dec 2002 20:41:46 -0500

"dukane" <dukane@NOSPAM.comcast.net> wrote in message
news:MPG.186c5d08d8ed801e9896f7@news-central.giganews.com...
> In article <v04vt4s1engf25@corp.supernews.com>, !0000@nomad.fake says...
> >
> > "dukane" <dukane@NOSPAM.comcast.net> wrote in message
> > news:MPG.186be4cdedf9ef069896f6@news-central.giganews.com...
> > > One thing I would do is send the file off to another virus scanner
> > > manufacturer. Most all of them will scan a file for you at their lab and
> > > let you know whether or not the file is infected. This will at least
> > > give you confirmation so you can provide proof to Norton that they
> > > dropped the ball on this one.
> > >
> > > You can just write that you believe the file is infected, Norton said
> > > no, but you want to make sure that their scanner will pick it up. Most
> > > will be happy to oblige in the hopes of making a customer out of you.
> > >
> > > The more I hear about Symanmtec's products and their support system, the
> > > more sure I am that their "day in the sun" is over. They seem to have
> > > just kicked back and are trusting on their (previous) reputation to keep
> > > them competitive. From my experience with their products, they have been
> > > in a downhill slide for the past several years, and their support is the
> > > pits.
> >
> > Do you expect AV software to be any better at picking up *new*
> > trojans than they are at picking up *new* viruses and worms?
> > I agree that they should have at least actually taken a look at the
> > file, and told the OP that his submission would be added to the
> > definition set (and thanked him). It seems mighty suspicious to me.
> >
>
> If the other follow-up poster is correct, and it sounds like he is, the
> trojan has been in the field for almost a month. In that case there is
> no excuse for Norton not to have recognized it, especially since they
> have it listed on their site. If that's the case then the scanner is
> very, very broken.

Someone may have re-worked the original (made somewhat minor
changes to it) to evade the already extant detection (by one or more
AV vendors product), and released the *new* version. It could also
be an actual *new* trojan.

> The reason I said to send it to another lab was to find out if another
> scanner did in fact pick it up.

Good idea, but some AV software might still recognize it as
the old trojan because the changes weren't great enough to
throw it off, even though it is new enough to evade others.

> I would have done it myself but the
> attachment containing the virus never showed up on my news server.

Didn't get it here either, but didn't check the crossposts.

> If it
> is in fact the Backdoor.Assasin.C trojan, the scanner should have picked
> it up as soon as it was d/led and trying to install itself.

I'm not sure how this works, but I think it should detect the
'trojan' before it tries to install the package.