Real World Test
(or why ESET NOD32 puts Symantec Endpoint and Microsoft Defender to shame)
This happened today, July 1st, 2009. And I used my personal copy of NOD32 to scan then removed it afterwards (ie: wiped the PC any ways).
At my workplace, a co-worker recently (and of course accidentally) infected his PC somehow. We knew it was an infection because his PC was sporadically playing random audio-only advertisements (really odd). It also changed his background image (which can be done with javascript anyways), and gave him pop-up ads with no browser running and sporadic intervals.
Here's the funny part: He already had Symantec Endpoint Anti-virus software already installed and updated, which is managed by the domain controller and Symantec deployment tools for businesses. He also had Microsoft Windows Defender already installed and updated. Even beyond that, on this XP system, he was running under a domain-controlled, limited user account (not part of the Administrator group or anything, very limited privs). All of this is our university's policy for security. And even more so, he only uses Firefox (as per our standard as well).
What he did not have was NoScript or Adblock for Firefox, nor ESET NOD32. Unfortunately, Symantec let a trojan slip through which stealthed itself to Symantec, disabled Windows Defender, and downloaded and installed another virus in the background (or vice versa of trojan/virus order).
I used HijackThis to remove some suspicious items at boot-up, then rebooted into the local Administrator account which hasn't been used since the system was infected. I then ran Symantec's Endpoint scanner on the entire C: drive (only partition on the system's hard drive). It found only one item, and it was just a tracking cookie.
I uninstalled Symantec and Windows Defender (Defender would not even launch and gave an error message).
I installed ESET's NOD32, version 4, and right after installed, NOD32 popped up a few "infiltration" messages in a row, meaning something was already infected in memory. It pointed to a couple system files that were compromised. But of course, unable to clean them since they were loaded in memory. I couldn't delete them either because of the same reason. But NOD32 prevented them from executing their malware code sections.
After a reboot, I had NOD32 scan the entire C: drive before even updating it. Sure enough, it found the trojan Kryptic.PE and the virus Virut.NBK. The total file count infected by the virus: 456 files.
If NOD32 was on this system at the time the trojan or virus attemtped to attack it, NOD32 would have prevented infection. Because it found it right away, even without any virus definition updates.