My son clicked a MSN virus link today: foto?? ha ha "webadress"his email@example.com
SAS pro realtimescanner reacted and said that the application was blocked but our computer got infected anyway and spammed all his friends (who was online) with the same message.
Shouldn't the realtime scanner terminate the malware completely and stop it from speading? strange.....
After a complete scan SAS found the malvare and removed it.
BTW My Norton antivirus did not react at all, one of his friends who use Nod 32 was protected ant the malware was terminated.