Starting next month, users of Symantec's Norton products will have a new tool to help them avoid unpatched software flaws.

Called the Symantec Online Network for Advanced Response (SONAR), the new security software will look at the behavior of programs running on the computer in order to decide whether they are malicious.  This is a departure from Symantec's traditional signature-based antivirus protection techniques, which compare the program's code to a database of known malware.

SONAR will be a free add-on to Symantec's Norton AntiVirus 2007 and Norton Internet Security 2007 products….

The software is built on technology that Symantec acquired in its 2005 purchase of WholeSecurity.

Over the weekend of January 13th and 14th, SONAR alerted Symantec to an increase of activity around a new packer. Based on the SONAR technology, we added detection in the field on Monda,y January 15th for the packer, which ended up being used on Wednesday, January 17th for Trojan.Peacomm (aka Storm Worm). Even though at this point the threat itself was not out, the early warning from SONAR drove some definition updates to deal with the new packer.

Since Storm Worm was detected via our virus definitions, it was not able to infect our customers’ machines. On a computer with up-to-date definitions it never started running and never got a chance to bring in its support files.

However, say a customer had turned off his/her protection and for that reason the system got infected. Even though the Trojan itself is not a running process (which is what SONAR analyzes) SONAR inspects all of the associated files that the Trojan downloads. SONAR detections are also reported back to Symantec. On Friday, January 19th we saw some changes in the Trojan’s support files, which SONAR submitted to Symantec, allowing us to update our definitions to account for the new packer.

As you can see, SONAR came into play as an early warning system the weekend before the threat was out, on Friday Jan 19th as the Trojan was being changed and as zero hour detection for the components of the Trojan.