Then why can NAI's Stinger "clean" the very same files that Norton cannot?

I know that they are clean because a) they run normally after cleaning and b) NAV no longer detects them as infected.

The section of the report that you reference below actually says:

Local and network file infection
The worm will also infect the files on the local and network shares, which match the following filenames. The worm appends itself and is polymorphic

Note the "appends" which means that it gloms itself onto the file, not that the legit file is replaced.  Please change the client behavior and save us all a ton of unnecessary work.  Thanks.


>From our understanding of the virus, the Bugbear infects and sometimes replaces legitimate applications such as Acrobat Reader, Media Payer, etc with itself.  If the virus replaces the original file, then original file is deleted and replaced with pure virus.
In such a case, the application can not be cleaned it must be deleted.


--

----------------------------------------------
Andrew Hendrickson
Information System Analyst
College of A & S Computing Services
UVM
479 Main Street, Room 302
Burlington, VT 05405-0144

(802) 656-7971
Fax (802) 656-3018
[log in to unmask]

For faster service, use our online request system:
http://footprints.uvm.edu/ashelp.html