Antivirus/Trojan/Spyware scanners DoS!

[No Spam]

Hello All,

Norton CE found five instances of the Eicar_test_file in roughly 8
seconds. It quarantined the .zip file.





Hello,

Here is what I have from TrendMicro IWSS v1

A virus (Compressed_Huge_File, Eicar_test_file, Eicar_test_file,
Eicar_test_file, Eicar_test_file, Eicar_test_file, Eicar_test_file) was
detected in file SERVER_dwn.zip in http traffic on 6/15/04 3:10:06 PM
with action deleted taken.

CPU on the server was between 80% and 90% for about
1.5 hours.




=09
__________________________________
Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo=20

[Ian Bergman]

SAV Corp 9.0 found six instances of eicar_test in 28 seconds of total
runtime on a test file server of no exceptional speed.

No real performance hit there.

-----Original Message-----
From: Bipin Gautam [mailto:visitbipin@hotmail.com]
Sent: Sunday, June 13, 2004 3:33 AM
To: bugtraq@securityfocus.com
Subject: Antivirus/Trojan/Spyware scanners DoS!



Hello everybody,



I doubt how many Antivirus/Trojan/Spyware scanners will choak to death while
having a "manual scan" of this file. Please go ahead and give it a try.



http://www.geocities.com/visitbipin/SERVER_dwn.zip



I was woundering, what would be the results if such file gets stucked in an
"AV gateway" (O;



please, report your findings..... I have already been bombarded with strange
reports.



regards,



Bipin Gautam

http://www.geocities.com/visitbipin/