Antivirus/Trojan/Spyware scanners DoS!

[Bipin Gautam]

Hello everybody,

I doubt how many Antivirus/Trojan/Spyware scanners will choak to death while having a "manual scan" of this file. Please go ahead and give it a try.

http://www.geocities.com/visitbipin/SERVER_dwn.zip

I was woundering, what would be the results if such file gets stucked in an "AV gateway" (O;

please, report your findings..... I have already been bombarded with strange reports.

regards,

Bipin Gautam
http://www.geocities.com/visitbipin/

[Romulo M. Cholewa]

Hi there,

I'm accessing the web right now through a Kerio Winroute Firewall with
McAfee protection (transparent proxy). Didn't detect at all while
downloading the file.

Once the download completed, manual scan with Symantec AV Corporate (8.1
with Client Security and defs. from 13/06/2004 rev. 17) properly =
detected
the eicar test strings and removed the files which means that the =
realtime
protection didn't work since the file was saved locally).

But the interesting thing is: I tried to send the file attached as a =
hotmail
message to myself. The rtvscan.exe process started eating up CPU, like =
it
entered a loop of some sort. I left it running for 20 minutes, and had =
to
kill it (the hotmail upload option timed out).

Romulo M. cholewa
Home: http://www.rmc.eti.br
News: http://www.rmc.eti.br/news
PGP key id 0x7F8A3B40


] -----Original Message-----
] From: Bipin Gautam [mailto:visitbipin@hotmail.com]=20
] Sent: Sunday, June 13, 2004 7:33 AM
] To: bugtraq@securityfocus.com
] Subject: Antivirus/Trojan/Spyware scanners DoS!
]=20
]=20
]=20
] Hello everybody,
]=20
]=20
]=20
] I doubt how many Antivirus/Trojan/Spyware scanners will choak=20
] to death while having a "manual scan" of this file. Please go=20
] ahead and give it a try.
]=20
]=20
]=20
] http://www.geocities.com/visitbipin/SERVER_dwn.zip
]=20
]=20
]=20
] I was woundering, what would be the results if such file gets=20
] stucked in an "AV gateway" (O;
]=20
]=20
]=20
] please, report your findings..... I have already been=20
] bombarded with strange reports.=20
]=20
]=20
]=20
] regards,
]=20
]=20
]=20
] Bipin Gautam
]=20
] http://www.geocities.com/visitbipin/
]=20

Hello,

Here is what I have from TrendMicro IWSS v1

A virus (Compressed_Huge_File, Eicar_test_file,
Eicar_test_file, Eicar_test_file, Eicar_test_file,
Eicar_test_file, Eicar_test_file) was detected in file
SERVER_dwn.zip in http traffic on 6/15/04 3:10:06 PM
with action deleted taken.

CPU on the server was between 80% and 90% for about
1.5 hours.

[Security List]

Hello,

Here is what I have from TrendMicro IWSS v1

A virus (Compressed_Huge_File, Eicar_test_file,
Eicar_test_file, Eicar_test_file, Eicar_test_file,
Eicar_test_file, Eicar_test_file) was detected in file
SERVER_dwn.zip in http traffic on 6/15/04 3:10:06 PM
with action deleted taken.

CPU on the server was between 80% and 90% for about
1.5 hours.





__________________________________
Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo