full-disclosure - Possible Virus activity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat Apr 23 13:53:17 2005
From: nocmonkey at gmail.com (Danny)
Subject: Possible Virus activity

On 4/22/05, Benjamin Krueger <benjamin@...ttlefenix.net> wrote:
> * Jonathan Grotegut (jgrotegut@...ectpointe.com) [050422 19:30]:
> > One of the things one of our techs has found is it is somehow related to Trend Office Scan, one of our techs killed all the services on one of the computer he could, he started them up one by one.  Once he started Trend Officescan service the System process spiked.  Possible update today on Trend that botched it?
> >
> > Jonathan Grotegut
> 
> http://kb.trendmicro.com/solutions/search/main/search/SolutionDetail.asp?SolutionID=24263&btnSearch=GO
> 
> "Windows XP Service Pack 2 machines with critical patches and OfficeScan Corporate Edition (OSCE) starts
> to experience high CPU utilization after updating to Pattern 594"
> 
> 594 was released today, and then 596 was released immediately afterwards. It looks like the machines
> having problems on my network are running 594 and weren't able to successfully update to 596. Coincidence?
> I think not.
> 
> Thanks Trend. You've ruined my Friday night. My girlfriend and I thank you...

A similar issue happened a couple of weeks ago with a false detection of:
<http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ%5FSMALL%2EAFG&VSect=T>

WTF is going on TrendMicro!  Test your f-ing pattern files before you
send them out!

...D