RE: Antivirus/Trojan/Spyware scanners DoS!

["Romulo M. Cholewa" <rmc () rmc eti br>]

Hi there,

I'm accessing the web right now through a Kerio Winroute Firewall with
McAfee protection (transparent proxy). Didn't detect at all while
downloading the file.

Once the download completed, manual scan with Symantec AV Corporate (8.1
with Client Security and defs. from 13/06/2004 rev. 17) properly detected
the eicar test strings and removed the files which means that the realtime
protection didn't work since the file was saved locally).

But the interesting thing is: I tried to send the file attached as a hotmail
message to myself. The rtvscan.exe process started eating up CPU, like it
entered a loop of some sort. I left it running for 20 minutes, and had to
kill it (the hotmail upload option timed out).

Romulo M. cholewa
Home: http://www.rmc.eti.br
News: http://www.rmc.eti.br/news
PGP key id 0x7F8A3B40


] -----Original Message-----
] From: Bipin Gautam [mailto:visitbipin () hotmail com] 
] Sent: Sunday, June 13, 2004 7:33 AM
] To: bugtraq () securityfocus com
] Subject: Antivirus/Trojan/Spyware scanners DoS!
] 
] 
] 
] Hello everybody,
] 
] 
] 
] I doubt how many Antivirus/Trojan/Spyware scanners will choak 
] to death while having a "manual scan" of this file. Please go 
] ahead and give it a try.
] 
] 
] 
] http://www.geocities.com/visitbipin/SERVER_dwn.zip
] 
] 
] 
] I was woundering, what would be the results if such file gets 
] stucked in an "AV gateway" (O;
] 
] 
] 
] please, report your findings..... I have already been 
] bombarded with strange reports. 
] 
] 
] 
] regards,
] 
] 
] 
] Bipin Gautam
] 
] http://www.geocities.com/visitbipin/
]