Sophos and Sobig

[Antony Stone]

On Thursday 21 August 2003 3:41 am, Hendrik den Hartog wrote:

> Curiosity..
>
>  If you have 2 virus scanners, do they both report the same virus if they
>  are both used on a message??

Each message is certainly passed through both scanners.

If both scanner have signatures for the virus, then both will report it, yes.

If it's a new virus and one of the scanners doesn't recognise it yet, you
will only get one report (one of the major benefits of running two scanners).

The only thing to watch out for perhaps is that the different anti-virus
scanners do not always agree on the same name for a virus (eg Blaster /
Troject.Dropper.C, or Nachi / Trojan.Dropper.D).

>  I was using Sophos, installed F-Prot as security RE: the recent postings
>  about Sophos missing these, and had F-Prot catch Sobig, but nothing from
>  Sophos?

Congratulations.   That's a very good reason to have more than one scanner.

Regards,

Antony.

--

Perfection in design is achieved not when there is nothing left to add,
but rather when there is nothing left to take away.

 - Antoine de Saint-Exupery