full-disclosure - Backdoor not recognized by Kaspersky

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: pauls at utdallas.edu (Schmehl, Paul L)
Subject: Backdoor not recognized by Kaspersky

> -----Original Message-----
> From: full-disclosure-admin@...ts.netsys.com 
> [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of 
> Suresh Ponnusami
> Sent: Wednesday, March 03, 2004 5:16 AM
> To: full-disclosure@...ts.netsys.com
> Subject: Re: [Full-Disclosure] Backdoor not recognized by Kaspersky
> 
> Another variant against the Netsky virus. It's is packed with 
> UPX. It spreads with the password protected zip file, which 
> gets bypassed through all most all the AV scanners with 
> latest signature updates because No AV can decrypt it without 
> the password. (though password is in the message content), we 
> humans tend to open it after reading the message.
> 
McAfee now detects the password protected zip files.  (There are other
things you can look for besides trying to decrypt the contents of the
zip filel  Also, zip passwords are weak and easily broken anyway.)

BTW, there is a war going on right now between three virus groups, so
you will continue to see new variants of Bagle, Netsky and Mydoom for
the foreseeable future.  Should be a very interesting month.

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/