bugtraq - RE: Antivirus/Trojan/Spyware scanners DoS!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ELEOLHOJFMBPBFCJHOCIOEPAEKAA.aditya.deshmukh@online.gateway.technolabs.net>
Date: Mon, 14 Jun 2004 07:56:53 +0530
From: "Aditya, ALD [Aditya Lalit Deshmukh]" <aditya.deshmukh@...ine.gateway.technolabs.net>
To: "bipin gautam" <visitbipin@...oo.com>, <full-disclosure@...ts.netsys.com>
Cc: <bugtraq@...urityfocus.com>, <vun-dev@...urityfocus.com>
Subject: RE: Antivirus/Trojan/Spyware scanners DoS!

> Ps: Please, reply with the version No. of the AV.
> scanner that you are using. If anyone of you have a
> test PC please test the file using the online virus
> scanners available at : http://virusall.com/downscan.html
> 

First of all this might be a social engg. attempt to find your antivirus versions and if the allow passing of malicious code thr.. so please santise your data before sending to the list 

> > I was woundering, what would be the results if such
> > file gets stucked in an "AV gateway" (O;
> > 

i conducted a test with the following antivirus - latest trail versions that were lying around

1. trend 2003
no stopping, but it decided to put the file in quarntine 

2. mcafee 6
stoped the system for 15 min

3. norton 2003
system had to rebooted after harddisk thrashing for 60 minutes

4. kav latest 
no stopping 

5. avg latest 
no stopping 

> -----------------------------
> * Winxp default zip manager just report the 12Gb zip
> file to be 121 Mb!???

some but in prasing the zip header in the winxp zip dll file ?

> * Winrar [3.20] can show the size of .bz2 files and
> winrar just report bipin.zip is 128 Mb but it start
> filling up the hdd. to 12 Gb if you try to extract the
> file.

no i was not able to reproduce this 

> *If we try to extract the 12 Gb [Standalone] file in
> Fat32 tries to extract the 12 Gb file and terminate
> extraction after 4Gb [fat32 limit] I wounder, why in
> the 1'st place would Winrar allow to extract a 4+ Gb
> [single] file in Fat 32.

this looks like a winrar prob, 
> Ps: Please, reply with the version No. of the AV.
> scanner that you are using. If anyone of you have a
> test PC please test the file using the online virus
> scanners available at : http://virusall.com/downscan.html
> 

First of all this might be a social engg. attempt to find your antivirus versions and if the allow passing of malicious code thr.. so please santise your data before sending to the list 

> > I was woundering, what would be the results if such
> > file gets stucked in an "AV gateway" (O;
> > 

i conducted a test with the following antivirus - latest trail versions that were lying around

1. trend 2003
no stopping, but it decided to put the file in quarntine 

2. mcafee 6
stoped the system for 15 min

3. norton 2003
system had to rebooted after harddisk thrashing for 60 minutes

4. kav latest 
no stopping 

5. avg latest 
no stopping 

> -----------------------------
> * Winxp default zip manager just report the 12Gb zip
> file to be 121 Mb!???

some but in prasing the zip header in the winxp zip dll file ?

> * Winrar [3.20] can show the size of .bz2 files and
> winrar just report bipin.zip is 128 Mb but it start
> filling up the hdd. to 12 Gb if you try to extract the
> file.

no i was not able to reproduce this 

> *If we try to extract the 12 Gb [Standalone] file in
> Fat32 tries to extract the 12 Gb file and terminate
> extraction after 4Gb [fat32 limit] I wounder, why in
> the 1'st place would Winrar allow to extract a 4+ Gb
> [single] file in Fat 32.

this looks like a winrar prob, 

-aditya

________________________________________________________________________
Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html