<<< Date Index >>>     <<< Thread Index >>>

Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through



Hi!

Thanks, that's interesting to read. In 2000, I've found and suggested the 
following in an article I've written for the Virus Bulletin magazine 
<http://www.virusbtn.com> :

"[...] Some scanners do not actually scan all files even when set to "scan all 
files" or when the mask "*.*" is used. Most of the time at least some infected 
.BAT, .VBS and .COM files will be missed if they have non-standard extensions. 
This happens when the scanner checks the file extension, not the content, in 
order to scan solely for this kind of virus. It would be a good idea for 
vendors to make a "smart" scan to find out the (hopefully) correct file format. 
If there is more than one possibility (like ASCII text or a .COM file), all 
possible supported formats should be scanned. [...]"

You can find this (Title: "The Usual Suspects ? Part 1", Dec 2000) and more 
related articles here:
<http://www.av-test.org/sites/references_papers.php3?lang=en>

cheers,
Andreas Marx
CEO, AV-Test.org
<http://www.av-test.org>


> Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through
> forged magic byte.

> AUTHOR: Andrey Bayora (www.securityelf.org)

> For more details, screenshots and examples please read my article "The Magic
> of magic byte" at www.securityelf.org . In addition, you will find a sample
> "triple headed" program which has 3 different 'execution entry points',
> depending on the extension of the file (exe, html or eml) - just change the
> extension and the SAME file will be executed by (at least) THREE DIFFERENT
> programs! (thanks to contributing author Wayne Langlois from
> www.diamondcs.com.au).

______________________________________________________________
Verschicken Sie romantische, coole und witzige Bilder per SMS!
Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193