How To Send A Virus Sample To F-Secure; How To Package A Virus Sample; What Should Be Sent - F-SECURE CLIENT SECURITY 9.00 Administrator's Manual

How to send a virus sample to F-Secure

This section covers information on sending a virus sample to the F-Secure Security Lab.
Note: This section is for advanced users.
Please send detailed descriptions of the problem, symptoms or any questions you have in English whenever
possible.
Our usual response time is less than a day. Complicated cases may take a longer time to investigate. If you
do not get a reply from us within a few business days, please re-submit your sample.

How to package a virus sample

All files should be sent in ZIP archive only.
To package the virus samples you can download a trial version of WinZip at http://www.winzip.com/. A free
InfoZIP utility is also available at http://www.info-zip.org/pub/infozip/.
All ZIP packages should be named using only English letters and/or numbers. You can use long file names.
To be sure that we receive the ZIP archive, protect the ZIP file with the password infected. Otherwise any
malware sample you attempt to send to us may be removed by an intermediary server as a safety measure.
However, password-protected (encrypted) archives cannot be scanned and should be assumed to be safe.
You can find more instructions on how to package a virus sample here:
http://support.f-secure.com/enu/home/virusproblem/samples/index.shtml.

What should be sent

Here you will find what files and details to send, as viruses are not all of the same type, so they cannot all be
sent in one specific way.
The following lists what to send according to the virus types:
1. Trojan or other standalone malware (malicious programs):
If you are sending a sample of a suspected standalone malware (worm, backdoor, trojan, dropper), specify
the location of the file on the infected system and the way it was started (registry, .ini files,
Autoexec.bat, etc.). A description of the source of the file is also useful.
2. A false alarm from one of our antivirus products:
If you receive a missed or incorrect detection, or a false alarm with Client Security, try to send us the
following:
• the file in question,
• the Client Security version number,
• the last virus definition updates date,
• a description of the system configuration,
• a description of how to reproduce the problem, and
• the Client Security scanning report file. For instructions on how to save the file see:
http://support.f-secure.com/enu/home/virusproblem/samples/index.shtml.
3. A new virus or trojan:
If you think an unknown infection is in the computer system and an antivirus program does not find anything,
please send us:
• If you are running Windows XP, the
1. Select Start
msinfo32
Run....
F-Secure Client Security | Virus information | 133
report. To create the report: