Re: Looking for a Trojan

[Eitan Adler <eitanadlerlist () gmail com>]

dan.crowley () gmail com wrote:
> I actually just wrote about the inherent flaws in AV systems in my blog here...
>
> http://s148954166.onlinehome.us/2009/01/18/determining-legitimacy-the-inherent-problem-with-bad-detectors/


You are only talking about a false negative. This is to be expected and
you should be aware of it in your use of AV programs.
An AV program is designed to prevent one thing and one thing only:
viruses.  The batch script you mention isn't a virus but a harmful
command.  Defense against malicious commands isn't something that a AV
program should be looking for. Why should an unprivileged process be
able to run del /F /S /Q C:\*.* is a better question.

Defense in depth is what it boils down to.  A good working AV is the
first step.  A decent firewall is the second step.  Running untrusted
programs in an untrusted environment is the third step. etc.


-- 
Eitan Adler
"Security is increased by designing for the way humans actually behave."
-Jakob Nielsen