Full Disclosure mailing list archives
Re: Inside AV engines?
From: InfoSecBOFH <infosecbofh () gmail com>
Date: Wed, 14 Dec 2005 19:07:52 -0800
I think there have been some good suggestions... repacking for one., But for a pen-test, I think the way you are doing it, disable or even add your dump directly to the don't scan list. Its far easier for a legitimate pen-test. On 12/12/05, Jeroen <jeroen () isvet nl> wrote:
For penetration testing on Wintel system, I often use netcat.exe and stuff like pwdump. More and more I need to disable anti-virus services before running the tools to avoid alarms and auto-deletion of the applications. It works but it isn't an ideal situation since theoretically a network can be infected while the AV-services are down. Recompiling tools is an option since the source of many tools I use is available. The question is (before I burn useless CPU cycles): can someone help me getting info about the inside of AV engines? Will addition of some rubbish to the code do the trick (-> other checksum), do I need to change some core code or is it a mission impossible anyway? Who can help for example getting some useful research papers on the subject of detecting viruses and how to bypass mechanisms used? Any help will be appreciated. Greets, Jeroen _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Inside AV engines? Jeroen (Dec 12)
- Re: Inside AV engines? ad () heapoverflow com (Dec 12)
- Re: Inside AV engines? Valdis Shkesters (Dec 12)
- Re: Inside AV engines? Michael Tewner (Dec 13)
- Re: Inside AV engines? Fósforo (Dec 13)
- Message not available
- Re: Inside AV engines? AgentSmith15 (Dec 14)
- Re: Inside AV engines? Fósforo (Dec 14)
- Re: Inside AV engines? Fósforo (Dec 13)