An antivirus vendor detects XYZ virus. You want to know if Symantec detects it.

Products

• Endpoint Protection

Issue/Introduction

An antivirus vendor detects XYZ virus. You want to know if Symantec's antivirus products detect this malware.

Resolution

Symantec cannot assure with 100% certainty that a threat is detected by the Symantec antivirus products (Symantec Endpoint Protection and others), even if it is acknowledged as a common alias in the "Also known as" field in a virus write up. It's a common practice in the antivirus industry to put different strains of the same virus under the same name. So, even if Symantec recognizes that w32.virusname.variant is also known as XYZ by another vendor, we may not detect all the variants that another vendor detects.

 

If you want to check if a virus detected by a competitor is mentioned in the Symantec write-ups:

1. Go to the Symantec home page
2. In the search text box type the name of the virus that's provided by another vendor
3. In the drop-down menu select "Viruses and Risks"
4. Click on Search
5. If the virus is mentioned in any of the Symantec public write-ups, you'll find it in the results page

This does not guarantee that the particular variant that the other vendor detects is detected by Symantec, as some vendors put different strains of a virus under the same name.

 

The only way to have 100% certainty whether or not Symantec detects a file with traditional antivirus signatures is to submit the file to Security Response.  For an explanation of the submission process, please see Symantec Insider Tip: Successful Submissions! And the document How to Use the Web Submission Process. 

If a specific MD5 or SHA-256 hash of the threat is known, and that threat is available from a public source like virustotal.com, please see Does Symantec Detect This: An Illustrated Guide to Public Hash Submission.

Note that SEP's heuristic, IPS, Reputation-based Insight (in SEP 12.1 and above) and Advanced Machine Learning (in SEP 14 and above) components may successfully block threats for which traditional antivirus signatures have not yet been written.  Using SEP's full suite of protection technologies is highly recommended in today's threat landscape.  See How to add or remove features to existing Symantec Endpoint Protection (SEP) client installations for instructions on how to add these components.