Likes Likes:  0
Resultaten 1 tot 6 van de 6
Geen

Onderwerp: Virus scan attack

  1. #1
    Nate Nord
    Virus scan attack
    Gast
    n/a Berichten
    Berichten zijn liked



    Thread Starter

    Virus scan attack

    Just wondering if anyone else has seen this come through their mail portal.
    Something has caused our McAfee Webshield SMTP to seriously eat processor
    time... to the point that it will no longer forward scanned mail. I've had
    to temporarily bypass it until I figure out what it's choking on. I saw
    several other posts that said this sent processors into some kind of loop
    and this is exactly what appears to be happening with our portal.


    ] -----Original Message-----
    ] From: Bipin Gautam [mailto:visitbipin@hotmail.com]
    ] Sent: Sunday, June 13, 2004 7:33 AM
    ] To: bugtraq@securityfocus.com
    ] Subject: Antivirus/Trojan/Spyware scanners DoS!
    ]
    ]
    ]
    ] Hello everybody,
    ]
    ]
    ]
    ] I doubt how many Antivirus/Trojan/Spyware scanners will choak
    ] to death while having a "manual scan" of this file. Please go
    ] ahead and give it a try.
    ]
    ]
    ]
    ] http://www.geocities.com/visitbipin/SERVER_dwn.zip
    ]
    ]
    ]
    ] I was woundering, what would be the results if such file gets
    ] stucked in an "AV gateway" (O;
    ]
    ]
    ]
    ] please, report your findings..... I have already been
    ] bombarded with strange reports.
    ]
    ]
    ]
    ] regards,
    ]
    ]
    ]
    ] Bipin Gautam
    ]
    ] http://www.geocities.com/visitbipin/


  2. #2
    Joao B. Diehl
    Virus scan attack
    Gast
    n/a Berichten
    Berichten zijn liked



    Thread Starter

    Re: Virus scan attack

    We had this same problem with the DAT 4367. Returning to
    DAT 4366 it worked again.


    Nate Nord wrote:
    > Just wondering if anyone else has seen this come through their mail portal.
    > Something has caused our McAfee Webshield SMTP to seriously eat processor
    > time... to the point that it will no longer forward scanned mail. I've had
    > to temporarily bypass it until I figure out what it's choking on. I saw
    > several other posts that said this sent processors into some kind of loop
    > and this is exactly what appears to be happening with our portal.
    >
    >
    > ] -----Original Message-----
    > ] From: Bipin Gautam [mailto:visitbipin@hotmail.com]
    > ] Sent: Sunday, June 13, 2004 7:33 AM
    > ] To: bugtraq@securityfocus.com
    > ] Subject: Antivirus/Trojan/Spyware scanners DoS!
    > ]
    > ]
    > ]
    > ] Hello everybody,
    > ]
    > ]
    > ]
    > ] I doubt how many Antivirus/Trojan/Spyware scanners will choak
    > ] to death while having a "manual scan" of this file. Please go
    > ] ahead and give it a try.
    > ]
    > ]
    > ]
    > ] http://www.geocities.com/visitbipin/SERVER_dwn.zip
    > ]
    > ]
    > ]
    > ] I was woundering, what would be the results if such file gets
    > ] stucked in an "AV gateway" (O;
    > ]
    > ]
    > ]
    > ] please, report your findings..... I have already been
    > ] bombarded with strange reports.
    > ]
    > ]
    > ]
    > ] regards,
    > ]
    > ]
    > ]
    > ] Bipin Gautam
    > ]
    > ] http://www.geocities.com/visitbipin/



  3. #3
    Vincent Archer
    Virus scan attack
    Gast
    n/a Berichten
    Berichten zijn liked



    Thread Starter

    Re: Virus scan attack

    On Sat, Jun 19, 2004 at 11:26:29AM -0300, Joao B. Diehl wrote:
    > We had this same problem with the DAT 4367. Returning to
    > DAT 4366 it worked again.
    >
    > Nate Nord wrote:
    > >Just wondering if anyone else has seen this come through their mail portal.
    > >Something has caused our McAfee Webshield SMTP to seriously eat processor
    > >time... to the point that it will no longer forward scanned mail. I've had
    > >to temporarily bypass it until I figure out what it's choking on. I saw
    > >several other posts that said this sent processors into some kind of loop
    > >and this is exactly what appears to be happening with our portal.


    Witnessed on a linux and solaris installs. In both cases, reverting to the
    previous dat archive restored function.

    --
    Vincent ARCHER
    Spécialiste système & sécurité
    varcher@deny-all.com <mailto:varcher@deny-all.com>
    Tel : +33 (0)1 40 07 47 14
    Fax : +33 (0)1 40 07 47 27
    Deny All - 5, rue Scribe - 75009 Paris - France
    www.deny-all.com


  4. #4
    Paul Knibbs
    Virus scan attack
    Gast
    n/a Berichten
    Berichten zijn liked



    Thread Starter

    Re: Virus Scan Attack

    This isn't a DoS as such. The problem occurs because the 4.1.60 scan
    engine for McAfee products isn't compatible with the 4367 DATs. In order
    to use these DATs you have to update your scan engine, which probably
    requires disabling WebShield and running the SuperDAT updater--this is
    what I had to do with our Exchange server (running GroupShield)
    yesterday morning!

    Nate Nord wrote:
    > Just wondering if anyone else has seen this come through their mail

    portal.
    > Something has caused our McAfee Webshield SMTP to seriously eat=20
    > processor time... to the point that it will no longer forward scanned=20
    > mail. I've had to temporarily bypass it until I figure out what it's=20
    > choking on. I saw several other posts that said this sent processors=20
    > into some kind of loop and this is exactly what appears to be

    happening with our portal.
    >=20



    Paul Knibbs
    Systems Administrator
    3T Productions Ltd
    T: 0161 492 1400 F: 0161 492 1401
    www.3t.co.uk



  5. #5
    Victor Julien
    Virus scan attack
    Gast
    n/a Berichten
    Berichten zijn liked



    Thread Starter

    Re: Virus scan attack

    Hi,

    We had the same problem with mcafee for linux. Upgrading the scanengine to
    4.2.30 solved the problem. We still used an old (and unsupported) version.
    See: ftp://ftp.nai.com/pub/ for a new version of the scanengine.

    Regards,
    Victor Julien

    On Saturday 19 June 2004 16:26, Joao B. Diehl wrote:
    > We had this same problem with the DAT 4367. Returning to
    > DAT 4366 it worked again.
    >
    > Nate Nord wrote:
    > > Just wondering if anyone else has seen this come through their mail
    > > portal. Something has caused our McAfee Webshield SMTP to seriously eat
    > > processor time... to the point that it will no longer forward scanned
    > > mail. I've had to temporarily bypass it until I figure out what it's
    > > choking on. I saw several other posts that said this sent processors
    > > into some kind of loop and this is exactly what appears to be happening
    > > with our portal.
    > >
    > >
    > > ] -----Original Message-----
    > > ] From: Bipin Gautam [mailto:visitbipin@hotmail.com]
    > > ] Sent: Sunday, June 13, 2004 7:33 AM
    > > ] To: bugtraq@securityfocus.com
    > > ] Subject: Antivirus/Trojan/Spyware scanners DoS!
    > > ]
    > > ]
    > > ]
    > > ] Hello everybody,
    > > ]
    > > ]
    > > ]
    > > ] I doubt how many Antivirus/Trojan/Spyware scanners will choak
    > > ] to death while having a "manual scan" of this file. Please go
    > > ] ahead and give it a try.
    > > ]
    > > ]
    > > ]
    > > ] http://www.geocities.com/visitbipin/SERVER_dwn.zip
    > > ]
    > > ]
    > > ]
    > > ] I was woundering, what would be the results if such file gets
    > > ] stucked in an "AV gateway" (O;
    > > ]
    > > ]
    > > ]
    > > ] please, report your findings..... I have already been
    > > ] bombarded with strange reports.
    > > ]
    > > ]
    > > ]
    > > ] regards,
    > > ]
    > > ]
    > > ]
    > > ] Bipin Gautam
    > > ]
    > > ] http://www.geocities.com/visitbipin/


  6. #6
    Joe Fubar
    Virus scan attack
    Gast
    n/a Berichten
    Berichten zijn liked



    Thread Starter

    Re: Virus scan attack

    Please check McAfees site if you are running an outdated engine,

    The 4.1.60 Engine is Out of Date and No Longer Supported
    The notice below addresses two separate issues tracked and brought to
    resolution by McAfee AVERT and Support as they pertain to the 4.1.60 and
    4.3.20 Engines
    Scenario 1
    The 4.1.60 Engine was officially EOL (End of Life) at the end of August 2003
    and is no longer supported. With the release of the 4367 DATs, on Wednesday
    June 16, 2004, customers began to notify AVERT and Network Associates
    Support of machines failing to initialize after installing or updating to
    the 4367/4.1.60 configuration. The two components are not compatible and the
    4.1.60 engine needs to be removed and an update needs to take place to the
    4.3.20 engine.

    This has been documented and you can get more information by reading our
    Primus Articles listed below.

    NAI37284 – NNT45 HFR Error Messages
    NAI37282 – Command Line Scanner Error Messages
    NAI37288 – VSC451SP1 Error Messages
    NAI37289 – VTC 6.1 Error Messages
    NAI37294 – GSE 5.0/5.2 Error Messages

    -----Original Message-----
    From: Joao B. Diehl [mailto:diehl@dpi.inpe.br]
    Sent: Saturday, June 19, 2004 16:26
    To: Nate Nord
    Cc: visitbipin@hotmail.com; bugtraq@securityfocus.com
    Subject: Re: Virus scan attack

    We had this same problem with the DAT 4367. Returning to
    DAT 4366 it worked again.


    Nate Nord wrote:
    > Just wondering if anyone else has seen this come through their mail
    > portal. Something has caused our McAfee Webshield SMTP to seriously
    > eat processor time... to the point that it will no longer forward
    > scanned mail. I've had to temporarily bypass it until I figure out
    > what it's choking on. I saw several other posts that said this sent
    > processors into some kind of loop and this is exactly what appears to
    > be happening with our portal.
    >


    --
    "Sie haben neue Mails!" - Die GMX Toolbar informiert Sie beim Surfen!
    Jetzt aktivieren unter http://www.gmx.net/info


Webhostingtalk.nl

Contact

  • Rokin 113-115
  • 1012 KP, Amsterdam
  • Nederland
  • Contact
© Copyright 2001-2026 Webhostingtalk.nl.
Web Statistics