full-disclosure - Inside AV engines?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon Dec 12 22:56:44 2005
From: jeroen at isvet.nl (Jeroen)
Subject: Inside AV engines?

For penetration testing on Wintel system, I often use netcat.exe and stuff
like pwdump. More and more I need to disable anti-virus services before
running the tools to avoid alarms and auto-deletion of the applications. It
works but it isn't an ideal situation since theoretically a network can be
infected while the AV-services are down. Recompiling tools is an option
since the source of many tools I use is available. The question is (before I
burn useless CPU cycles): can someone help me getting info about the inside
of AV engines? Will addition of some rubbish to the code do the trick (->
other checksum), do I need to change some core code or is it a mission
impossible anyway? Who can help for example getting some useful research
papers on the subject of detecting viruses and how to bypass mechanisms
used? Any help will be appreciated.

Greets,

Jeroen