Re:Virus proliferation (Score 1)

Just FYI - Some viruses are re-using code of prior viruses which may trigger a previous signature. This works for variants when they are not packed and are not polymorphic and the analyst wrote a good signature (i.e. chose the right part of the virus for the signature string). In cases of worms - such as the Plug and Play variants - IPS signatures could be blocking the exploit part of the worm - and when an AV vendor also supplies IPS products... I will not be surprised if what has cought the worm proactivly was the IPS signature due to the exploit code which was public - being used in the worm...