Basic Trojan entry question

I'm one of the lucky ones that hasn't had problems with Trojans. I use a
firewall, NAT, and keep all my comptuters updated, and of course I'm very
careful in my web surfing. A friend of mine, however, is having trouble.
He uses Norton, which he keeps updated, but he's getting trojans. The
interesting part to me is that the trojans are not detected upon entry.
Norton finds them during a scan. I don't use Norton, but my friend inists
that he's got the full suite of products, which includes real-time scanning
and protection - web, downloads, and email. Why is the trojan getting in
undetected, only to turn up during a scan?

thank you,

jm

"Jake" <jake.DeleteThis@yahoo.com> wrote in message
news:OByDe.22852$B52.12845@tornado.ohiordc.rr.com...
> I'm one of the lucky ones that hasn't had problems with Trojans. I
use a
> firewall, NAT, and keep all my comptuters updated, and of course I'm
very
> careful in my web surfing.

If you ever have to make a decision about whether or not to execute a
new program on your machine, you run the risk of executing a traditional
trojan. Firewalls, anti-malware, and updated machines won't help you
unless the trojan in question is detectable by the anti-malware program
'and' you have it somehow scan the file.

> A friend of mine, however, is having trouble.
> He uses Norton, which he keeps updated, but he's getting trojans. The
> interesting part to me is that the trojans are not detected upon
entry.
> Norton finds them during a scan. I don't use Norton, but my friend
inists
> that he's got the full suite of products, which includes real-time
scanning
> and protection - web, downloads, and email. Why is the trojan getting
in
> undetected, only to turn up during a scan?

Many types of exploit code are detected and identified as 'trojans' by
the anti-malware programs and as such you can expect to find Java
vulnerability exploits like java.byteverify and others in caches while
browsing. On access AV can be expected to find these when they are
opened and containing the exploit code but not necessarily when they are
opened for the writing of the code into the file - also some AV's will
scan the caches as part of a scheduled scan and notice them then.

Not knowing what trojans and where they were found leaves little to go
on to determine how they get in.