Re[2]: [Full-Disclosure] All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV]

[3APA3A <3APA3A@xxxxxxxxxxxxxxxx>]

Dear bipin gautam,


OK.  I  just wrote new super antivirus. It's databases currently consist
from  only  eicar.com  signature  (I'm very new in this business) but it
100% detects EICAR in the file with removed permissions :)

http://www.security.nnov.ru/files/antieicar.zip

Sorry, it currently hangs on DOS devices... May be in future version...

Now, there is at least one antivirus to break your statement :)

--Saturday, October 2, 2004, 5:02:24 PM, you wrote to 
full-disclosure@xxxxxxxxxxxxxxxx:

bg> Ok ya... i already mentioned the fact,  If the scanner
bg> is unable to drop the privilege and run under the
bg> security content of "dumb_user" the malicious code
bg> goes undetected. Correct me if i am wrong, but....
bg> mostly (full-)system "manual scan" is executed as a
bg> administrative job......... and i've already mentioned
bg> the fact, its MORE* a NTFS file permission problem.


-- 
~/ZARAZA
...без дубинки никогда не принимался он за программирование. (Лем)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html