RE: Long path exploit on NTFS

From: Didier Arenzana (darenzana@yahoo.fr)
Date: 02/05/02


Date: Tue, 5 Feb 2002 09:59:14 +0100 (CET)
From: Didier Arenzana <darenzana@yahoo.fr>
To: "Fleming, Diane" <dfleming@fnni.com>, bugtraq@securityfocus.com

Hello,
I've tried the script with virus scan 4.5.0.534, signature file 4.0.4183.

o If VirusShield is active while runing the script, it detects both files
and prevent their generation, but crashes on the second one. However, even
after the crash it's still active. The ceation of viruses is still not
possible, but you are not warned anymore.

o If VirusShield is not active while runing the script, and you scan the
disk afterwards, the first file is detected and removed, the second one is
not, and there is no error message of any kind.

Regards,
Didier.

 --- "Fleming, Diane" <dfleming@fnni.com> a écrit :
> Any information as to whether or not McAfee Virus Scan 4.x has this
> vulnerability?
>
> -----Original Message-----
> From: Frank Heyne [mailto:fh@rcs.urz.tu-dresden.de]
> Sent: Monday, February 04, 2002 1:15 PM
> To: bugtraq@securityfocus.com; hans.somers@hccnet.nl
> Subject: Re: Long path exploit on NTFS
>
>
> On 4 Feb 2002, at 10:26, Hans Somers wrote:
>
> > Not Vunerable:
> > --------------
> > *1
> > Sophos Anti-Virus v3.53
>
> This is not true.
>
> According to my own tests, Sophos Anti-Virus v3.53
> is unable to find virii in deeply nested NTFS subdirectories on NT 4.
>
>
>
> Frank Heyne
>
>
>

___________________________________________________________
Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français !
Yahoo! Mail : http://fr.mail.yahoo.fr



Relevant Pages

  • Re: Microsoft: piracy is getting virusy
    ... The worm is 10001 bytes long DOS-based program that ... The worm finally drops a Visual Basic script file ... listed in PATH= variable for COM and EXE files and then infects them. ... The virus is a very fast infector. ...
    (alt.comp.anti-virus)
  • Re: How does a malware effect a program and get loaded by Windows?
    ... .exe file and have your malware /virus infect ... I can see how you can disguise a virus to look like a legitimate ... Batch File CHM - Compiled HTML Help File CMD - Windows NT Command ... Registration Entries SCR - Screen Saver SCT - Windows Script ...
    (alt.comp.anti-virus)
  • Re: How does a malware effect a program and get loaded by Windows?
    ... .exe file and have your malware /virus infect ... I can see how you can disguise a virus to look like a legitimate ... Batch File CHM - Compiled HTML Help File CMD - Windows NT Command ... Registration Entries SCR - Screen Saver SCT - Windows Script ...
    (alt.comp.anti-virus)
  • Re: Viruses and Linux
    ... There are a difference between *nix systems and microsoft windows, ... So the one who writes say an Evolution script, this scriptwriter, if he wants ... Next you need to get the virus to the next machine, ...
    (alt.os.linux)
  • Re: Help fails
    ... Basically something has killed my ability to run "Help and Support" ... I did find this after posting and ran the VB script. ... check even though I have not heard of a virus doing this but none ... I know one of the file cleaning programs can cause this and I ...
    (alt.os.windows-xp)