Re: [Full-disclosure] Re: McAfee VirusScan vs Metasploit Framework v2.x

[Steve Friedl <steve@xxxxxxxxxxx>]

On Sat, Dec 10, 2005 at 01:53:59PM -0800, Fyodor wrote:
> Competitors such as Trend Micro and Norton seem to focus on
> actual malware.

Not so fast: Symantec Corporate edition v10 flags Famatech's RAdmin
(remote administrator) as badware, mainly because it's been used by
Trojans in the past as a remote control mechanism. I know that if I didn't
use this software on my network, I'd want to know that it was somewhere.

But a customer *does* use this software, and there is no centralized
way to tell it "Ignore RAdmin if it's in the expected place" or at least
"Ignore RAdmin"; it has to be excluded by hand in a couple of places on
each desktop, and it's just been a nightmare.

>From what I understand, Symantec has not been terribly concerned about
this, and I'm sure the poor folks at Famatech are beside themselves.

Steve

--- 
Stephen J Friedl | Security Consultant |  UNIX Wizard  |   +1 714 544-6561
www.unixwiz.net  | Tustin, Calif. USA  | Microsoft MVP | steve@xxxxxxxxxxx
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/