Antivirus vendor Trend Micro last week admitted that its enterprise OfficeScan software suffers from a product limitation that stops it from detecting particular viruses until they have infected a system.
The limitation affects systems running OfficeScan in default mode. There has been only one reported problem so far, but to fix the problem, the affected company, Roc Office Furniture, was advised by Trend Micro to install PC-Cillin, a standalone version of OfficeScan intended for home users.
Gary Jukes, IT support technician at Roc, contacted Trend Micro following an infection by the well-known and damaging TROJ_MTX.A virus, also referred to as the Apology virus. He said that the version of OfficeScan he was running on his system did not detect the virus on access, and allowed the file to execute and infect the system. "Once the system was infected, OfficeScan detected the virus and attempted to clean it [but could not]," said Jukes.
Raj Paneffar, product marketing manager at Trend Micro, said that the virus had been able to avoid the default scanning procedure because the virus writer had added '.pif' to the end of the file name.
In an earlier email to Jukes, Trend Micro's support department wrote: "When a virus file located on floppy or any folder on the local [hard disk] is executed/double clicked, OfficeScan will not be able to detect the virus right away, but when the process is closed, then only will OfficeScan detect the virus and will try to clean/remove it." The email said that the single-user PC-Cillin software does not behave the same way and "can intercept virus-infected files on the process of opening, unlike OfficeScan".
Trend Micro said that its developers were investigating the matter.
