RE: The incredible gayness of antivirus-vendors and their products (in this case, NAV corp. ed.)

["Justin Shin" <zorkshin () tampabay rr com>]

$freelsd = "Where?"

-- Justin Shin :-)

-----Original Message-----
From: full-disclosure-admin () lists netsys com
[mailto:full-disclosure-admin () lists netsys com]On Behalf Of Knud
Højgaard
Sent: Thursday, July 10, 2003 4:38 AM
To: full-disclosure () lists netsys com
Cc: bugtraq () securityfocus com
Subject: [Full-disclosure] The incredible gayness of antivirus-vendors
and their products (in this case, NAV corp. ed.)


On this wonderful morning what do my eyes see? 
A dialog box saying the following to me:

Scan type:  Realtime Protection Scan
Event:  Virus Found!
Virus name: Hacktool
File:  C:\Documents and Settings\kaka\Local Settings\Temporary Internet Files\Content.IE5\AVININWN\DSR-youbin[1].pl
Location:  Quarantine
Computer:  KAKA
User:  kaka
Action taken:  Clean failed : Quarantine succeeded : Access denied
Date found: Thu Jul 10 08:55:43 2003

The file in question is http://kokanins.homepage.dk/DSR-youbin.pl

The obvious retardedness of labelling my damn generic exploit as being a virus aside, it strikes me as 'funny' that I 
am still available to:

Select the text in my browser,
create a "new text document",
paste the contents and save it to disk,
and without any nagging from the puny AV-software:
access the file,
rename it (the "new text document") to the original filename,
still access it via an editor, 
and even execute it via my cygwin environment.

Let's turn our attention to http://kokanins.homepage.dk/rs_iis_xpl.pl

The same sort of bullshit as above except "Virus name: FreeBSD.Rootkit".
Uh, that's incorrect to say the least - this is no rootkit.

This time the antivirus software succeeds in its mission - it quarantines the file.
However, changing "$freebsd_string" to "$freelsd_string" is enough to fool the software, allowing execution of the file 
etc. as in the previous example.

Antivirus-software is protection for people against yesterdays threats. 
Antivirus-software is protection for moronic users against themselves.
Antivirus-software is crap. I say we kill the users and be done with it.

Datfile ver. 50709f // updated today 
NAV ver. 7.51.847 // oh no, I am exposing
Scan engine ver. 4.1.0.6 // dangerous info here

--
kokaninATdtors.net
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html