Additional anti-virus questions answered.

Reader response to last issue's article, "'Deadbolt' your computer and 'Don't talk to strangers,' anti-virus expert advises," included the following questions which we forwarded to Anson Lee, program manager at Symantec Corporation, parent company of the popular Norton Anti-Virus program.

Q. How come you cannot download even one's own software--say, from a floppy disk--without turning off the anti-virus program?

A. Viruses can reach a computer in many ways, such as through files downloaded from the internet, e-mail attachments, floppy disks, CD-ROMs, etc. As a best practice, all of these items need to be checked for viruses each time they are used. In other words, when you insert a floppy disk into the drive, check it for viruses. The user, of course, has the option to turn off the anti-virus program, but we do not recommend it.

Q. Some cynics believe that some viruses and worms are actually created by personnel in anti-virus companies, to give them new business. Have you heard the rumors and is there any truth to them?

A. This comes up on a regular basis and our answer is simple. Symantec does not hire ex-virus writers, for both ethical and pragmatic reasons. The most important reason is that we believe it is wrong to hire someone who has actively created or released malicious code into the wild. In addition, the engineering skill sets involved in creating vs. analyzing malicious code samples are very different, so there is no benefit gained from their experience.

Q. Has Symantec itself ever been infected with a virus?

A. Symantec has a number of safeguards built into our virus lab security architecture to keep malicious code isolated, including air-gaping of this lab from the rest of the engineering networks. We also implement a security in-depth posture for our main network systems to protect against external and internal events.

Q. Why do anti-virus programs work on a subscription model, paying so much a year? Why not a program that one can buy and use indefinitely--with its own updates built in? A related question: Why do subscribers have to spend sometimes a lot of time running updates, rather than having the updates built into the software?

A. New viruses, worms, Trojan horses, etc. are discovered all the time. In turn, anti-virus programs need to be kept up-to-date with 'virus definitions' to catch these new threats as they emerge. Norton Anti-Virus has a feature called Automatic Live-Update which will automatically check for virus protection updates when the user is connected to the internet. If updates are available, Automatic Live-Update will download and apply the updates for the user automatically--thereby ensuring that the user has the latest protection.

Anson Lee, Symantec Corp. 20330 Stevens Creek Blvd., Cupertino, CA 95014, 408-517-8000, www.symantec.com