OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re[2]: [Full-Disclosure] All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV]

From: 3APA3A (3APA3ASECURITY.NNOV.RU)
Date: Sat Oct 02 2004 - 09:57:03 CDT

Dear bipin gautam,

OK. I just wrote new super antivirus. It's databases currently consist
from only eicar.com signature (I'm very new in this business) but it
100% detects EICAR in the file with removed permissions :)

http://www.security.nnov.ru/files/antieicar.zip

Sorry, it currently hangs on DOS devices... May be in future version...

Now, there is at least one antivirus to break your statement :)

--Saturday, October 2, 2004, 5:02:24 PM, you wrote to full-disclosurelists.netsys.com:

bg> Ok ya... i already mentioned the fact, If the scanner
bg> is unable to drop the privilege and run under the
bg> security content of "dumb_user" the malicious code
bg> goes undetected. Correct me if i am wrong, but....
bg> mostly (full-)system "manual scan" is executed as a
bg> administrative job......... and i've already mentioned
bg> the fact, its MORE* a NTFS file permission problem.

--
~/ZARAZA
...без дубинки никогда не принимался он за программирование. (Лем)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html