Detection failure can happen in several scenarios. This article provides a checklist to help you confirm that a valid detection failure has occurred. To learn more about common causes of detection failure, see the articles mentioned in the "Related Information" section.
Before you submit a sample to our Advanced Research Center, perform the following to confirm that a valid detection failure has occurred:
- Confirm that the on-access scanner (OAS) was not in a disabled state at the time the suspected malware was copied.
- Check the configuration of the OAS and verify the following:
- The path location where the suspicious file resides isn't excluded from the scan.
- The OAS doesn't have Scan on write disabled.
- Confirm that the DAT file on the system is the latest available production DAT. We typically release updated DAT files regularly between 12 p.m. and 1 p.m. (CST).
- Perform a full system scan after you make sure that the DAT file is the latest available.
NOTES:
- When you perform a scan, we recommend that you use and raise the sensitivity to at least Medium for the OAS settings in ENS.
- GTI is another detection that's separate from DAT files and commonly produces a detection in the form of 'Artemis!<MD5 hash>,' when the DAT files don't contain detection for the threat.
After confirming that your product configuration is
not at fault and the DAT files are up to date, contact Technical Support for further assistance.
Malware, specifically
trojan infections, are highly dynamic, and change quickly. We can help you with sample collection to submit suspicious files to Advanced Research Center for analysis; the Advanced Research Center can then provide extra detection information.
- If you are a registered user, type your User ID and Password, and then click Log In.
- If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.
