Virus scan attack

[Nate Nord]

Just wondering if anyone else has seen this come through their mail portal.
Something has caused our McAfee Webshield SMTP to seriously eat processor
time... to the point that it will no longer forward scanned mail. I've had
to temporarily bypass it until I figure out what it's choking on. I saw
several other posts that said this sent processors into some kind of loop
and this is exactly what appears to be happening with our portal.


] -----Original Message-----
] From: Bipin Gautam [mailto:visitbipin@hotmail.com]
] Sent: Sunday, June 13, 2004 7:33 AM
] To: bugtraq@securityfocus.com
] Subject: Antivirus/Trojan/Spyware scanners DoS!
]
]
]
] Hello everybody,
]
]
]
] I doubt how many Antivirus/Trojan/Spyware scanners will choak
] to death while having a "manual scan" of this file. Please go
] ahead and give it a try.
]
]
]
] http://www.geocities.com/visitbipin/SERVER_dwn.zip
]
]
]
] I was woundering, what would be the results if such file gets
] stucked in an "AV gateway" (O;
]
]
]
] please, report your findings..... I have already been
] bombarded with strange reports.
]
]
]
] regards,
]
]
]
] Bipin Gautam
]
] http://www.geocities.com/visitbipin/

[Joao B. Diehl]

We had this same problem with the DAT 4367. Returning to
DAT 4366 it worked again.


Nate Nord wrote:
> Just wondering if anyone else has seen this come through their mail portal.
> Something has caused our McAfee Webshield SMTP to seriously eat processor
> time... to the point that it will no longer forward scanned mail. I've had
> to temporarily bypass it until I figure out what it's choking on. I saw
> several other posts that said this sent processors into some kind of loop
> and this is exactly what appears to be happening with our portal.
>
>
> ] -----Original Message-----
> ] From: Bipin Gautam [mailto:visitbipin@hotmail.com]
> ] Sent: Sunday, June 13, 2004 7:33 AM
> ] To: bugtraq@securityfocus.com
> ] Subject: Antivirus/Trojan/Spyware scanners DoS!
> ]
> ]
> ]
> ] Hello everybody,
> ]
> ]
> ]
> ] I doubt how many Antivirus/Trojan/Spyware scanners will choak
> ] to death while having a "manual scan" of this file. Please go
> ] ahead and give it a try.
> ]
> ]
> ]
> ] http://www.geocities.com/visitbipin/SERVER_dwn.zip
> ]
> ]
> ]
> ] I was woundering, what would be the results if such file gets
> ] stucked in an "AV gateway" (O;
> ]
> ]
> ]
> ] please, report your findings..... I have already been
> ] bombarded with strange reports.
> ]
> ]
> ]
> ] regards,
> ]
> ]
> ]
> ] Bipin Gautam
> ]
> ] http://www.geocities.com/visitbipin/

[Vincent Archer]

On Sat, Jun 19, 2004 at 11:26:29AM -0300, Joao B. Diehl wrote:
> We had this same problem with the DAT 4367. Returning to
> DAT 4366 it worked again.
>
> Nate Nord wrote:
> >Just wondering if anyone else has seen this come through their mail portal.
> >Something has caused our McAfee Webshield SMTP to seriously eat processor
> >time... to the point that it will no longer forward scanned mail. I've had
> >to temporarily bypass it until I figure out what it's choking on. I saw
> >several other posts that said this sent processors into some kind of loop
> >and this is exactly what appears to be happening with our portal.

Witnessed on a linux and solaris installs. In both cases, reverting to the
previous dat archive restored function.

--
Vincent ARCHER
Spécialiste système & sécurité
varcher@deny-all.com <mailto:varcher@deny-all.com>
Tel : +33 (0)1 40 07 47 14
Fax : +33 (0)1 40 07 47 27
Deny All - 5, rue Scribe - 75009 Paris - France
www.deny-all.com

[Paul Knibbs]

This isn't a DoS as such. The problem occurs because the 4.1.60 scan
engine for McAfee products isn't compatible with the 4367 DATs. In order
to use these DATs you have to update your scan engine, which probably
requires disabling WebShield and running the SuperDAT updater--this is
what I had to do with our Exchange server (running GroupShield)
yesterday morning!

Nate Nord wrote:
> Just wondering if anyone else has seen this come through their mail
portal.
> Something has caused our McAfee Webshield SMTP to seriously eat=20
> processor time... to the point that it will no longer forward scanned=20
> mail. I've had to temporarily bypass it until I figure out what it's=20
> choking on. I saw several other posts that said this sent processors=20
> into some kind of loop and this is exactly what appears to be
happening with our portal.
>=20


Paul Knibbs
Systems Administrator
3T Productions Ltd
T: 0161 492 1400 F: 0161 492 1401
www.3t.co.uk

[Victor Julien]

Hi,

We had the same problem with mcafee for linux. Upgrading the scanengine to
4.2.30 solved the problem. We still used an old (and unsupported) version.
See: ftp://ftp.nai.com/pub/ for a new version of the scanengine.

Regards,
Victor Julien

On Saturday 19 June 2004 16:26, Joao B. Diehl wrote:
> We had this same problem with the DAT 4367. Returning to
> DAT 4366 it worked again.
>
> Nate Nord wrote:
> > Just wondering if anyone else has seen this come through their mail
> > portal. Something has caused our McAfee Webshield SMTP to seriously eat
> > processor time... to the point that it will no longer forward scanned
> > mail. I've had to temporarily bypass it until I figure out what it's
> > choking on. I saw several other posts that said this sent processors
> > into some kind of loop and this is exactly what appears to be happening
> > with our portal.
> >
> >
> > ] -----Original Message-----
> > ] From: Bipin Gautam [mailto:visitbipin@hotmail.com]
> > ] Sent: Sunday, June 13, 2004 7:33 AM
> > ] To: bugtraq@securityfocus.com
> > ] Subject: Antivirus/Trojan/Spyware scanners DoS!
> > ]
> > ]
> > ]
> > ] Hello everybody,
> > ]
> > ]
> > ]
> > ] I doubt how many Antivirus/Trojan/Spyware scanners will choak
> > ] to death while having a "manual scan" of this file. Please go
> > ] ahead and give it a try.
> > ]
> > ]
> > ]
> > ] http://www.geocities.com/visitbipin/SERVER_dwn.zip
> > ]
> > ]
> > ]
> > ] I was woundering, what would be the results if such file gets
> > ] stucked in an "AV gateway" (O;
> > ]
> > ]
> > ]
> > ] please, report your findings..... I have already been
> > ] bombarded with strange reports.
> > ]
> > ]
> > ]
> > ] regards,
> > ]
> > ]
> > ]
> > ] Bipin Gautam
> > ]
> > ] http://www.geocities.com/visitbipin/

[Joe Fubar]

Please check McAfees site if you are running an outdated engine,

The 4.1.60 Engine is Out of Date and No Longer Supported
The notice below addresses two separate issues tracked and brought to
resolution by McAfee AVERT and Support as they pertain to the 4.1.60 and
4.3.20 Engines
Scenario 1
The 4.1.60 Engine was officially EOL (End of Life) at the end of August 2003
and is no longer supported. With the release of the 4367 DATs, on Wednesday
June 16, 2004, customers began to notify AVERT and Network Associates
Support of machines failing to initialize after installing or updating to
the 4367/4.1.60 configuration. The two components are not compatible and the
4.1.60 engine needs to be removed and an update needs to take place to the
4.3.20 engine.

This has been documented and you can get more information by reading our
Primus Articles listed below.

NAI37284 – NNT45 HFR Error Messages
NAI37282 – Command Line Scanner Error Messages
NAI37288 – VSC451SP1 Error Messages
NAI37289 – VTC 6.1 Error Messages
NAI37294 – GSE 5.0/5.2 Error Messages

-----Original Message-----
From: Joao B. Diehl [mailto:diehl@dpi.inpe.br]
Sent: Saturday, June 19, 2004 16:26
To: Nate Nord
Cc: visitbipin@hotmail.com; bugtraq@securityfocus.com
Subject: Re: Virus scan attack

We had this same problem with the DAT 4367. Returning to
DAT 4366 it worked again.


Nate Nord wrote:
> Just wondering if anyone else has seen this come through their mail
> portal. Something has caused our McAfee Webshield SMTP to seriously
> eat processor time... to the point that it will no longer forward
> scanned mail. I've had to temporarily bypass it until I figure out
> what it's choking on. I saw several other posts that said this sent
> processors into some kind of loop and this is exactly what appears to
> be happening with our portal.
>

--
"Sie haben neue Mails!" - Die GMX Toolbar informiert Sie beim Surfen!
Jetzt aktivieren unter http://www.gmx.net/info