Security Incidents mailing list archives
RE: strange windows behaviour.
From: Harlan Carvey <keydet89 () yahoo com>
Date: Thu, 9 Oct 2003 15:28:45 -0700 (PDT)
Paul,
There's been a lot of discussion about this amongst av professionals. There's really no advantage to scanning streams because they are "inert". In order for the trojan to do anything, it has to "come out of hiding" as it were, and when it does, av on access scanning will detect it **if it's a known trojan**. While it's in the stream it's merely in storage, not being used.
Can you elaborate on "has to come out of hiding"? I've repeatedly demonstrated how an executable can be written to an ADS and launched directly from that location, without having to be copied to another location, such as a temp file. The same is true on Win2K systems and above with VB and JavaScript files. Thanks for anything you can provide. Harlan --------------------------------------------------------------------------- ----------------------------------------------------------------------------
Current thread:
- Re: strange windows behaviour., (continued)
- Re: strange windows behaviour. J Mike Rollins (Oct 08)
- Re: strange windows behaviour. H Carvey (Oct 08)
- Re: strange windows behaviour. Peter Moody (Oct 08)
- Re: strange windows behaviour. Harlan Carvey (Oct 08)
- Re: strange windows behaviour. Peter Moody (Oct 08)
- Re: strange windows behaviour. Derek (Oct 08)
- RE: strange windows behaviour. Schmehl, Paul L (Oct 09)
- RE: strange windows behaviour. J Mike Rollins (Oct 09)
- Re: strange windows behaviour. Jeff Kell (Oct 09)
- Re: strange windows behaviour. J Mike Rollins (Oct 09)
- Re: strange windows behaviour. Tobias Rice (Oct 10)
- RE: strange windows behaviour. J Mike Rollins (Oct 09)
- RE: strange windows behaviour. Harlan Carvey (Oct 09)
- Administrivia: strange windows behaviour. Dan Hanson (Oct 09)
- RE: strange windows behaviour. Chris Brenton (Oct 09)
- RE: strange windows behaviour. Pepijn Vissers (Oct 09)
- Re: strange windows behaviour. Karl Levinson (Oct 09)
- Re: strange windows behaviour. Harlan Carvey (Oct 10)
- RE: strange windows behaviour. Schmehl, Paul L (Oct 09)
- RE: strange windows behaviour. J Mike Rollins (Oct 09)
- RE: strange windows behaviour. Harley David (Oct 10)
- RE: strange windows behaviour. Harley David (Oct 10)
- RE: strange windows behaviour. Schmehl, Paul L (Oct 10)