RE: MS MSRT

[Drsolly <drsollyp () drsolly com>]

On Fri, 3 Feb 2006, Todd Towles wrote:

> They released the MS MSRT early during the Zotob worm, why not now? 
>
> I agree that the MSRT isn't suppose to replace AV and it isn't really
> MS's job to remove malware from my computer. But why not release it
> early if it were already created and ready? Or if you could get it out
> without a couple of days without a "huge" effort?
>
> Would they have released it if the infection rate was up to 600,000 or 1
> million?
 
Should they have released it if the infection rate was just a few 
thousand?

It's always a judgement call whether to do an extra release, because it 
will put some people to a certain amount of trouble (I'm guessing that 
corporates won't let patches auto-install, but would want to test that 
they don't break something imortant before rolling them out). You might do 
an extra release if there's strong evidence of a widespread problem. But 
in this case, there wasn't strong evidence - am I right in thinking that 
all the AV companies rate this as a minor threat, and it's only the 
Blackworm Task Force that is the driving force behind the publicity?

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.