RE: Show me the Virrii!

["Richard Gadsden" <Richard.Gadsden () cobbetts co uk>]

Steve Wray <mailto:steve.wray () paradise net nz> wrote on Monday, 5 January 2004 8:36 a.m.:

> > From: full-disclosure-admin () lists netsys com
> > On Behalf Of S G Masood
> > Sent: Monday, 5 January 2004 9:40
> > Subject: Re: [Full-disclosure] Show me the Virrii!
> >
> > --- Richard Maudsley <r_i_c_h () btopenworld com> wrote:
> ...
> > > How do big Anti-Virus companies get their hands on
> > > new viruses, and how can I?
> >
> > Various methods. Some of them are:
> ...
> > 4. When their heuristic engines pick up new viruses
> > automatically, they usually have some kind of an ...
>
> Does anyone have reliable reports of an antivirus system firing
> off on a heuristic?
>
> I'm not aware of ever having seen one; always seems to be a
> signature.

Yes; I've seen AV firing off at Welchi as a Blaster variant on a heuristic.

Some AV software fired off when anything exploited the Blaster hole.

-- Richard
Apologies about the excessive .sig below
==================================================
Cobbetts and Birmingham based Lee Crowder have
agreed to merge in a deal that will create a top
50 law firm.  The merger will be effective from 1
May 2004, although with effect from 1 December 2003
the name Cobbetts Lee Crowder will be used in the
Birmingham office.  For further information
http://www.cobbetts.co.uk/news57.html
==================================================
Confidentiality Notice: The information contained in this e-mail 
is for the intended recipient(s) alone. It may contain privileged 
and confidential information that is exempt from disclosure under 
English law and if you are not an intended recipient, you must not
copy, distribute or take any action in reliance on it. If you have
received this e-mail in error, please notify us immediately either
by using the reply facility on your e-mail system or by contacting
us at the address below. If this message is being transmitted 
over the Internet, be aware that it may be intercepted by third 
parties. 

Cobbetts offices are at:
Ship Canal House, King Street, Manchester, M2 4WB,
England. 
Telephone: +44 161 833 3333; Fax: +44 161 833 3030.

Trafalgar House, 29 Park Place, Leeds, LS1 2SP,
England.
Telephone: +44 113 246 8123; Fax +44 113 244 2863
www.cobbetts.co.uk

This firm is authorised by the FSA to conduct investment 
business.
=================================================

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html