RE: [Full-Disclosure] Antivirus/Trojan/Spyware scanners DoS!

["Aditya, ALD [Aditya Lalit Deshmukh]" <aditya.deshmukh@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>]

> Ps: Please, reply with the version No. of the AV.
> scanner that you are using. If anyone of you have a
> test PC please test the file using the online virus
> scanners available at : http://virusall.com/downscan.html
> 

First of all this might be a social engg. attempt to find your antivirus 
versions and if the allow passing of malicious code thr.. so please santise 
your data before sending to the list 

> > I was woundering, what would be the results if such
> > file gets stucked in an "AV gateway" (O;
> > 

i conducted a test with the following antivirus - latest trail versions that 
were lying around

1. trend 2003
no stopping, but it decided to put the file in quarntine 

2. mcafee 6
stoped the system for 15 min

3. norton 2003
system had to rebooted after harddisk thrashing for 60 minutes

4. kav latest 
no stopping 


5. avg latest 
no stopping 

> -----------------------------
> * Winxp default zip manager just report the 12Gb zip
> file to be 121 Mb!???

some but in prasing the zip header in the winxp zip dll file ?

> * Winrar [3.20] can show the size of .bz2 files and
> winrar just report bipin.zip is 128 Mb but it start
> filling up the hdd. to 12 Gb if you try to extract the
> file.

no i was not able to reproduce this 

> *If we try to extract the 12 Gb [Standalone] file in
> Fat32 tries to extract the 12 Gb file and terminate
> extraction after 4Gb [fat32 limit] I wounder, why in
> the 1'st place would Winrar allow to extract a 4+ Gb
> [single] file in Fat 32.


this looks like a winrar prob, 
> Ps: Please, reply with the version No. of the AV.
> scanner that you are using. If anyone of you have a
> test PC please test the file using the online virus
> scanners available at : http://virusall.com/downscan.html
> 

First of all this might be a social engg. attempt to find your antivirus 
versions and if the allow passing of malicious code thr.. so please santise 
your data before sending to the list 

> > I was woundering, what would be the results if such
> > file gets stucked in an "AV gateway" (O;
> > 

i conducted a test with the following antivirus - latest trail versions that 
were lying around

1. trend 2003
no stopping, but it decided to put the file in quarntine 

2. mcafee 6
stoped the system for 15 min

3. norton 2003
system had to rebooted after harddisk thrashing for 60 minutes

4. kav latest 
no stopping 


5. avg latest 
no stopping 

> -----------------------------
> * Winxp default zip manager just report the 12Gb zip
> file to be 121 Mb!???

some but in prasing the zip header in the winxp zip dll file ?

> * Winrar [3.20] can show the size of .bz2 files and
> winrar just report bipin.zip is 128 Mb but it start
> filling up the hdd. to 12 Gb if you try to extract the
> file.

no i was not able to reproduce this 

> *If we try to extract the 12 Gb [Standalone] file in
> Fat32 tries to extract the 12 Gb file and terminate
> extraction after 4Gb [fat32 limit] I wounder, why in
> the 1'st place would Winrar allow to extract a 4+ Gb
> [single] file in Fat 32.


this looks like a winrar prob, 


-aditya


________________________________________________________________________
Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html