full-disclosure - All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV]

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

From: 3APA3A at SECURITY.NNOV.RU (3APA3A)
Subject: All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV]

Dear bipin gautam,

OK.  I  just wrote new super antivirus. It's databases currently consist
from  only  eicar.com  signature  (I'm very new in this business) but it
100% detects EICAR in the file with removed permissions :)

http://www.security.nnov.ru/files/antieicar.zip

Sorry, it currently hangs on DOS devices... May be in future version...

Now, there is at least one antivirus to break your statement :)

--Saturday, October 2, 2004, 5:02:24 PM, you wrote to full-disclosure@...ts.netsys.com:

bg> Ok ya... i already mentioned the fact,  If the scanner
bg> is unable to drop the privilege and run under the
bg> security content of "dumb_user" the malicious code
bg> goes undetected. Correct me if i am wrong, but....
bg> mostly (full-)system "manual scan" is executed as a
bg> administrative job......... and i've already mentioned
bg> the fact, its MORE* a NTFS file permission problem.

-- 
~/ZARAZA
...??? ??????? ??????? ?? ?????????? ?? ?? ????????????????. (???)