Thanks in advance.

For checking for websites, use iehv.exe from nirsoft and point it to the temporary internet files location – that will give you the websites that were visited and the date/time of the virus infection will tell you what site they were looking at.

The idea that symantec’s upgrade of the engine/program does not work with liveupdates or definition updates is crazy. Also the fact that the default installation for the updates also means that every machine silently reboots, which is very scary when you run this for the first time on a network and every pc shuts down – you can hear the progress from the screens.

I’ve also had symantec fail to catch virus’s that have been out for 3 or 4 years .

Sophos comes from the UK and has pretty good ratings from a lot of the virus reviewers, avg tends to get poor detection scores, fine for home users, but I wouldn’t trust it on a corporate network.

First of all I want to say that it was a great show as always. Regarding your virus / malware problem, here are some tips:

-You can use Web Historian (http://www.mandiant.com/webhistorian.htm) to find out the link the file came from. Most probably the page in question contained an exploit for IE and automatically downloaded and executed the file in the background. I don’t want you to accuse you of not patching the systems , I just say that this is usually how it works.

An other way to find out more information about a malware is to submit the file to sites which scan it with multiple AV engines (a list of which can be found on my blog: http://hypefree.blogspot.com/2007/03/how-to-submit-suspected-malware-samples.html) and then search for the different names under which it is detected.

Also you can submit the sample to the support of your AV company directly and ask them for removal instructions (also, because you have such a great show I would like to offer a free analysis of the file – I’m a virus researcher at a AV company – send me an email if you are interested)

Using an AV product different from the “big two” and low reaction time can keep you protected more often (you can read about the reasons on my blog: http://hypefree.blogspot.com/2007/04/active-vs-reactive-protection.html). A very good independent testing organization is AV-Comparatives: http://www.av-comparatives.org/

http://teachers.yahoo.com/

Interesting, to say the least.

http://www.justin.tv/

-Claudio

I almost fell off my chair when I heard one of you (I think it was the “Mac snob” :-p ) say that OS X runs Linux under the hood. That’s incorrect. Darwin, which is an offshoot of the BSDs, is what runs under the hood. The kernel is based off of FreeBSD.

Just thought I would pass that from one Mac Snob to another.

(Actually, I love Linux, the BSDs, and OS X….can’t say that much about Windows though. :-p)

Thanks for another great podcast!

Claudio