[GLLUG] First-hand lessons on the perils of monoculture

[Clay Dowling]

Mark Thuemmel wrote:
> Seems like a pretty old problem....February Symantec had it in their
> definition file.....Are you pointing the finger at your office for the
> problem or Symantec?
>
> Here is a link to their removal tool:
> http://www.symantec.com/security_response/writeup.jsp?docid=2009-020411-2802-99&tabid=2
>   
a) the removal tool is worthless. We tried it, it didn't work.

b) My office, for relying on a known piece of crapware just because it's
what everyone else uses. 


Starting in safe mode and running symantec, it is often able to remove
the virus.  It's a slow and tedious process.  What worked fast was
downloaded Avast free edition, installing it and doing the boot-time
startup. That creamed the virus right away. Much faster and easier than
the symantec solution.

Based on the performance of the two, I know where I'd spend my
anti-virus dollar. I'll raise it with the boss on Monday. Our scan on
access protection should have caught this thing before it got loose, but
failed.

Clay