Re: [Full-Disclosure] Antivirus/Trojan/Spyware scanners DoS!

[Ahmed Motaz <amotaz@xxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

bipin gautam wrote:

| I wounder how many Antivirus/Trojan/Spyware scanners will choak to
| death while having a manual scan of the file

I have tried it with Norton AntiVirus 2003 on a PIII 550/256 MB RAM
machine. It
took it 8 minutes to scan 42 files before I aborted it.

I was curious how you crafted such a ZIP file. It extracts to 125KB
and then extracts to more than 500 MB.

| I was woundering, what would be the results if such file gets
| stucked in an "AV gateway" (O;

If there was no timeout, then it definitely can crash lots of these.

I, however, like to add that this is not a problem with the AV
software; I tried extracting it manually using WinRAR and WinZIP, but
it took forever, especially the file ~.rar, which is 6 MB before
extraction.

I have tried it with online scanner, Kaspersky
(http://www.kaspersky.com/scanforvirus), but the scan did not take
more than 1 minute and detected 15 virus bodies out of 692 scanned files.

I'd like to hear more about it soon.

Regards,
Ahmed Motaz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAzIXCxSm8vaS5lh8RAruBAJ9Giaap/vtDwxOmh4MDzYMs/A3hUQCeJuqX
DLJ+H/hHhIYMPiFWDqxw3O8=
=HVzd
-----END PGP SIGNATURE-----


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html