Re: Latest dist v5.2

[Fyodor <fyodor () insecure org>]

On Tue, Jan 26, 2010 at 05:31:42PM -0600, Ron wrote:
> > Have you (or anyone else) tested to make sure this will solve the
> > problem? If not, I guess what we'll have to do is build the installer
> > and submit it to the same links as in
> > http://seclists.org/nmap-dev/2010/q1/211.
>
> No, I didn't test it, but somebody commented that changing just the
> first bit is enough to overcome the scanner. I change every bit,
> though, and the encoder isn't built in, so there isn't really any way
> an a/v scanner would pick it up.

We should have tested :(.  Now I'm getting reports that
nmap_services.exe triggers Panda Antivirus W32/Xor-encoded.A:

http://www.cloudantivirus.com/en/threat-information/Xor-encoded.A/194318/

VirusTotal finds that as well:

http://www.virustotal.com/analisis/5938478eb7195e53ba408b6fc390b35f2ccff6e68b761da4a5dfab97f3164a9c-1264630143

-F
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/