Re: denial-of-service vulnerability in the Microsoft Malicious Software Removal Tool

[Christian Sciberras <uuf6429 () gmail com>]

When I am logged in as Admin and try to replace NDIS.SYS, Windows
File Protection replaces it.  Why did WFP fail to protect the file
against Cutwail in the first place, and how can a virus replace
NDIS.SYS using Administrative privs, if I cannot do it myself when
Administrator?

You can't blame anyone for your incompetence, WFP is there to keep your
system running, not acting as an antivirus (today many people seem to think
that antiviruses should be put everywhere, starting from web browsers
themselves!)

If memory serves me right, in your case you just had to delete the file from
WFP cache folder and then the real file. The worst thing to you would be a 5
min search on Google.


Lastly, sure the system (might) be unbootable, but where's the virus?

You can boot into MS Recovery console and repair your system (missing driver
etc) but you can't do an antivirus scan reliably from recovery console; for
one thing such functionality is not available and another, antivirus can't
determine certain kinds of virii since they need to be at least loaded (if
not running) (example; MSI VBS-generic/self-mutating).

Cheers.



On Sun, May 23, 2010 at 9:43 PM, lsi <stuart () cyberdelix net> wrote:

> On 23 May 2010 at 23:57, webDEViL wrote:
>
> > All said and done, that doesn't make it a vulnerability.
>
> Tell that to my customer (wait until I've invoiced them, though).
>
> Stu
>
> ---
> Stuart Udall
> stuart at () cyberdelix dot net - http://www.cyberdelix.net/
>
> ---
>  * Origin: lsi: revolution through evolution (192:168/0.2)
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/