lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20040614090454.C546@bigb3server.bbcluster.gr>
From: bigbrother at bonbon.net (BigBrother-{BigB3})
Subject: Antivirus/Trojan/Spyware scanners DoS!

>
> On Sun, Jun 13, 2004 at 03:30:17AM -0700, bipin gautam wrote:
>> Hello everybody,
>>
>> I wounder how many Antivirus/Trojan/Spyware scanners
>> will choak to death while having a manual scan of the
>> file:
>>
>> http://www.geocities.com/visitbipin/SERVER_dwn.zip
>>
>> I was woundering, what would be the results if such
>> file gets stucked in an "AV gateway" (O;
>>
>> please, report your findings.....
>
> F-Prot 4.4.2 for Linux.
>
> Looks like deadlocked. :(
>


Tested:

F-Prot 4.1.1   (FreeBSD 4.10)

no problem at all (took 40 seconds on my 300Mhz box)






Virus scanning report  -  14 June 2004 @ 9:05

F-PROT ANTIVIRUS
Program version: 4.1.1
Engine version: 3.13.4

VIRUS SIGNATURE FILES
SIGN.DEF created 11 June 2004
SIGN2.DEF created 11 June 2004
MACRO.DEF created 7 June 2004

Search: SERVER_dwn.zip
Action: Report only
Files: Attempt to identify files
Switches: <none>

SERVER_dwn.zip->BlackHole.zip->1/~.cab->0.cab->cab.com  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->1/~.zip->bipin.zip  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->2/~.cab->0.cab->cab.com  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->2/~.zip->bipin.zip  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->3/~.cab->0.cab->cab.com  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->3/~.zip->bipin.zip  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->4/~.cab->0.cab->cab.com  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->4/~.zip->bipin.zip  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->5/~.cab->0.cab->cab.com  Infection: 
EICAR_Test_File
SERVER_dwn.zip->BlackHole.zip->5/~.zip->bipin.zip  Infection: 
EICAR_Test_File

Results of virus scanning:

Files: 1
MBRs: 0
Boot sectors: 0
Objects scanned: 32
Infected: 10
Suspicious: 0
Disinfected: 0
Deleted: 0
Renamed: 0

Time: 0:40




---
Dreams have no limits!


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ