Also there’s ways we can examine executables that the AV vendors just can’t do (because of the desktop thing). A good way of thinking about this is that on the typical desktop there’s millions of files and executables, but for the most part nobody emails them to eachother (you don’t email someone notepad.exe). So a false positive on a desktop scanner can be really critical, but when you’re just scanning email you know you can be a bit more aggressive.

Finally, all viruses are basically evolutions of the one that came before it. Virus writers don’t tend to write a brand new virus - they take their previous code and modify it slightly, tweaking it until they find it gets through the version of McAffee or Sophos they have installed. Then they send it out. So we create heuristics that can detect variations on the themes.

I make it sound simpler than it is really - but we saw this flaw in the usual AV techniques and took the opportunity to fix it.

Thanks for the point, Matt. I think all readers (plus me) would love some additional explanation on what you guys do differently. May be set an example for the commercial folks (proprietary methods exclusive, of course)?