full-disclosure - Multiple Antivirus Scanners DoS attack. [summery]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: krok at sdf.lonestar.org (Jim Krok)
Subject: Multiple Antivirus Scanners DoS attack.
 [summery]

>
> It has been few reports F-Prot 4.4.2 for Linux has a problem!!!
>

F-PROT 4.4.2 worked fine for me, although it took a little time (about 5
minutes).  I tried this with an older version 3.12d which found the same 
results in 20 seconds.  Also, in case you weren't aware, F-Prot Antivirus 
for Linux is free for home use, so you might want to do your own tests.

F-PROT 4.4.2
   Infection: EICAR_Test_File
   Time: 4.53

F-PROT 3.12d
   Infection: EICAR_Test_File
   Time: 0:20

cpuinfo: Intel(R) Pentium(R) III Mobile CPU      1000MHz
MemTotal:       516116 kB
SwapTotal:      128516 kB

Here's a short summary of the results I got along with some cpu & mem 
info.  The complete results returned by both versions are attached below.



--jim





$ ./f-prot SERVER_dwn.zip
Virus scanning report  -  14. June 2004   18:07

F-PROT 3.12d
SIGN.DEF created 12. June 2004
SIGN2.DEF created 12. June 2004
MACRO.DEF created 7. June 2004

Search: SERVER_dwn.zip
Action: Report only
Files: Attempt to identify files
Switches: <none>

SERVER_dwn.zip->BlackHole.zip->1/~.cab->0.cab->cab.com  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->1/~.zip->bipin.zip  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->2/~.cab->0.cab->cab.com  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->2/~.zip->bipin.zip  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->3/~.cab->0.cab->cab.com  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->3/~.zip->bipin.zip  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->4/~.cab->0.cab->cab.com  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->4/~.zip->bipin.zip  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->5/~.cab->0.cab->cab.com  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->5/~.zip->bipin.zip  Infection: 
EICAR_Test_File

Results of virus scanning:

Files: 1
MBRs: 0
Boot sectors: 0
Objects scanned: 32
Infected: 10
Suspicious: 0
Disinfected: 0
Deleted: 0
Renamed: 0

Time: 0:20





$ ./f-prot SERVER_dwn.zip
Virus scanning report  -  14 June 2004 @ 18:08

F-PROT ANTIVIRUS
Program version: 4.4.2
Engine version: 3.14.11

VIRUS SIGNATURE FILES
SIGN.DEF created 12 June 2004
SIGN2.DEF created 12 June 2004
MACRO.DEF created 7 June 2004

Search: SERVER_dwn.zip
Action: Report only
Files: "Dumb" scan of all files
Switches: -ARCHIVE -PACKED -SERVER

SERVER_dwn.zip->BlackHole.zip->1/~.cab->0.cab->cab.com  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->1/~.zip->bipin.zip  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->2/~.cab->0.cab->cab.com  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->2/~.zip->bipin.zip  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->3/~.cab->0.cab->cab.com  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->3/~.zip->bipin.zip  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->4/~.cab->0.cab->cab.com  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->4/~.zip->bipin.zip  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->5/~.cab->0.cab->cab.com  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->5/~.zip->bipin.zip  Infection: 
EICAR_Test_File

Results of virus scanning:

Files: 1
MBRs: 0
Boot sectors: 0
Objects scanned: 657
Infected: 10
Suspicious: 0
Disinfected: 0
Deleted: 0
Renamed: 0

Time: 4:53