[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-Disclosure] Multiple Antivirus Scanners DoS attack. [summery]

To: full-disclosure@xxxxxxxxxxxxxxxx
Subject: Re: [Full-Disclosure] Multiple Antivirus Scanners DoS attack. [summery]
From: Jim Krok <krok@xxxxxxxxxxxxxxxx>
Date: Mon, 14 Jun 2004 19:11:45 -0500 (CDT)

It has been few reports F-Prot 4.4.2 for Linux has a problem!!!

F-PROT 4.4.2 worked fine for me, although it took a little time (about 5 minutes). I tried this with an older version 3.12d which found the same results in 20 seconds. Also, in case you weren't aware, F-Prot Antivirus for Linux is free for home use, so you might want to do your own tests.

F-PROT 4.4.2
  Infection: EICAR_Test_File
  Time: 4.53

F-PROT 3.12d
  Infection: EICAR_Test_File
  Time: 0:20

cpuinfo: Intel(R) Pentium(R) III Mobile CPU      1000MHz
MemTotal:       516116 kB
SwapTotal:      128516 kB

Here's a short summary of the results I got along with some cpu & mem info. The complete results returned by both versions are attached below.

--jim

$ ./f-prot SERVER_dwn.zip
Virus scanning report  -  14. June 2004   18:07

F-PROT 3.12d
SIGN.DEF created 12. June 2004
SIGN2.DEF created 12. June 2004
MACRO.DEF created 7. June 2004

Search: SERVER_dwn.zip
Action: Report only
Files: Attempt to identify files
Switches: <none>

SERVER_dwn.zip->BlackHole.zip->1/~.cab->0.cab->cab.com Infection: EICAR_Test_File SERVER_dwn.zip->BlackHole.zip->1/~.zip->bipin.zip Infection: EICAR_Test_File SERVER_dwn.zip->BlackHole.zip->2/~.cab->0.cab->cab.com Infection: EICAR_Test_File SERVER_dwn.zip->BlackHole.zip->2/~.zip->bipin.zip Infection: EICAR_Test_File SERVER_dwn.zip->BlackHole.zip->3/~.cab->0.cab->cab.com Infection: EICAR_Test_File SERVER_dwn.zip->BlackHole.zip->3/~.zip->bipin.zip Infection: EICAR_Test_File SERVER_dwn.zip->BlackHole.zip->4/~.cab->0.cab->cab.com Infection: EICAR_Test_File SERVER_dwn.zip->BlackHole.zip->4/~.zip->bipin.zip Infection: EICAR_Test_File SERVER_dwn.zip->BlackHole.zip->5/~.cab->0.cab->cab.com Infection: EICAR_Test_File SERVER_dwn.zip->BlackHole.zip->5/~.zip->bipin.zip Infection: EICAR_Test_File

Results of virus scanning:

Files: 1
MBRs: 0
Boot sectors: 0
Objects scanned: 32
Infected: 10
Suspicious: 0
Disinfected: 0
Deleted: 0
Renamed: 0

Time: 0:20

$ ./f-prot SERVER_dwn.zip
Virus scanning report  -  14 June 2004 @ 18:08

F-PROT ANTIVIRUS
Program version: 4.4.2
Engine version: 3.14.11

VIRUS SIGNATURE FILES
SIGN.DEF created 12 June 2004
SIGN2.DEF created 12 June 2004
MACRO.DEF created 7 June 2004

Search: SERVER_dwn.zip
Action: Report only
Files: "Dumb" scan of all files
Switches: -ARCHIVE -PACKED -SERVER

Files: 1
MBRs: 0
Boot sectors: 0
Objects scanned: 657
Infected: 10
Suspicious: 0
Disinfected: 0
Deleted: 0
Renamed: 0

Time: 4:53

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

References:
- Re: [Full-Disclosure] Multiple Antivirus Scanners DoS attack. [summery]
  - From: bipin gautam

Prev by Date: [Full-Disclosure] Dull-Disclosure
Next by Date: Re: [Full-Disclosure] FD info prompts M$ to summon the FBI on spy-vertisers
Previous by thread: Re: [Full-Disclosure] linux kernel local crash seen on slashdot
Next by thread: Re: [Full-Disclosure] Multiple Antivirus Scanners DoS attack. [summery]
Index(es):
- Date
- Thread