Vulnerability Development mailing list archives

Re: Another new worm???


From: Dan_Schrader () TRENDMICRO COM (Dan Schrader)
Date: Wed, 21 Jun 2000 01:01:22 -0700


I will summarize all the reponses in one post.

Accusations of commercial advantage are are way off base and show a lack of
understanding of the AV business.

It doesn't matter which antivirus vendor you give it too.  There are
contractual agreements between most AV vendors to share viruses on request.
In addition, 20+ AV vendors recently formed an organization called Rapid
Exchange of Virus Samples (REVS) designed to facilitate the distribution of
viruses among those who need them.  If you are one of those people, contact
Joe Wells at wildlist.org and join the group.

The last thing any AV vendor needs is more viruses - we get (no
exaggeration) over 500 new viruses a month.  Thousands of files are sent to
us each month for analysis.

What I was trying to do was reduce the likelyhood of copy cat viruses.  AV
vendors have a firm policy of never giving virus samples to anyone who we
are not sure will be responsible in their handling of the virus.

For those few people who need to do their own analysis, there are faster,
safer ways of getting the code then relying on someone sending it to you
over on uncontrolled email group days or weeks after the av vendors had
analyzed the virus and provided detailed descriptions of it on our web
sites.  By last Friday every major av vendor had posted write-ups

Justin - my problem had nothing to do with problems handling viruses, you
should try reading more carefully.

jjday@ebixquay.etnay  - if the problem were a product design flaw that the
manufacturer refused to address, I would support posting of all details.
But in the antivirus world we are dealing with thousands of kids who are
actively seeking to break our defenses - giving them ammunition is foolish.

Let me ask the list, did one person on this list use this posting to better
protect their environment?

Dan Schrader
Trend Micro


Current thread: