Full Disclosure mailing list archives

Re: Multiple Antivirus Scanners DoS attack. [summery]

From: Jim Krok <krok () sdf lonestar org>
Date: Mon, 14 Jun 2004 19:11:45 -0500 (CDT)


It has been few reports F-Prot 4.4.2 for Linux has a problem!!!


F-PROT 4.4.2 worked fine for me, although it took a little time (about 5

minutes). I tried this with an older version 3.12d which found the sameresults in 20 seconds. Also, in case you weren't aware, F-Prot Antivirusfor Linux is free for home use, so you might want to do your own tests.


F-PROT 4.4.2
  Infection: EICAR_Test_File
  Time: 4.53

F-PROT 3.12d
  Infection: EICAR_Test_File
  Time: 0:20

cpuinfo: Intel(R) Pentium(R) III Mobile CPU      1000MHz
MemTotal:       516116 kB
SwapTotal:      128516 kB

Here's a short summary of the results I got along with some cpu & meminfo. The complete results returned by both versions are attached below.




--jim





$ ./f-prot SERVER_dwn.zip
Virus scanning report  -  14. June 2004   18:07

F-PROT 3.12d
SIGN.DEF created 12. June 2004
SIGN2.DEF created 12. June 2004
MACRO.DEF created 7. June 2004

Search: SERVER_dwn.zip
Action: Report only
Files: Attempt to identify files
Switches: <none>

SERVER_dwn.zip->BlackHole.zip->1/~.cab->0.cab->cab.com Infection:EICAR_Test_FileSERVER_dwn.zip->BlackHole.zip->1/~.zip->bipin.zip Infection:EICAR_Test_FileSERVER_dwn.zip->BlackHole.zip->2/~.cab->0.cab->cab.com Infection:EICAR_Test_FileSERVER_dwn.zip->BlackHole.zip->2/~.zip->bipin.zip Infection:EICAR_Test_FileSERVER_dwn.zip->BlackHole.zip->3/~.cab->0.cab->cab.com Infection:EICAR_Test_FileSERVER_dwn.zip->BlackHole.zip->3/~.zip->bipin.zip Infection:EICAR_Test_FileSERVER_dwn.zip->BlackHole.zip->4/~.cab->0.cab->cab.com Infection:EICAR_Test_FileSERVER_dwn.zip->BlackHole.zip->4/~.zip->bipin.zip Infection:EICAR_Test_FileSERVER_dwn.zip->BlackHole.zip->5/~.cab->0.cab->cab.com Infection:EICAR_Test_FileSERVER_dwn.zip->BlackHole.zip->5/~.zip->bipin.zip Infection:EICAR_Test_File


Results of virus scanning:

Files: 1
MBRs: 0
Boot sectors: 0
Objects scanned: 32
Infected: 10
Suspicious: 0
Disinfected: 0
Deleted: 0
Renamed: 0

Time: 0:20





$ ./f-prot SERVER_dwn.zip
Virus scanning report  -  14 June 2004 @ 18:08

F-PROT ANTIVIRUS
Program version: 4.4.2
Engine version: 3.14.11

VIRUS SIGNATURE FILES
SIGN.DEF created 12 June 2004
SIGN2.DEF created 12 June 2004
MACRO.DEF created 7 June 2004

Search: SERVER_dwn.zip
Action: Report only
Files: "Dumb" scan of all files
Switches: -ARCHIVE -PACKED -SERVER


Results of virus scanning:

Files: 1
MBRs: 0
Boot sectors: 0
Objects scanned: 657
Infected: 10
Suspicious: 0
Disinfected: 0
Deleted: 0
Renamed: 0

Time: 4:53

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Current thread:

Re: Multiple Antivirus Scanners DoS attack. [summery], (continued)
- Re: Multiple Antivirus Scanners DoS attack. [summery] npguy (Jun 14)
  - Re: Multiple Antivirus Scanners DoS attack. [summery] bipin gautam (Jun 14)
    - Re: Multiple Antivirus Scanners DoS attack. [summery] Jan Muenther (Jun 14)
    - Re: Multiple Antivirus Scanners DoS attack. [summery] bipin gautam (Jun 14)
    - Re: Multiple Antivirus Scanners DoS attack bipin gautam (Jun 14)
    - linux kernel local crash seen on slashdot Skip Duckwall (Jun 14)
    - Re: linux kernel local crash seen on slashdot Lorenzo Hernandez Garcia-Hierro (Jun 14)
    - Re: linux kernel local crash seen on slashdot npguy (Jun 14)
    - Re: linux kernel local crash seen on slashdot Stefan SF (Jun 15)
    - Re: linux kernel local crash seen on slashdot Dave Monnier, IT Security Office, Indiana University (Jun 15)
    - Re: Multiple Antivirus Scanners DoS attack. [summery] Jim Krok (Jun 14)
    - Re: Multiple Antivirus Scanners DoS attack. [summery] npguy (Jun 14)
- Re: Multiple Antivirus Scanners DoS attack. [summery] William Warren (Jun 14)