[13769] in bugtraq
Re: Bypass Virus Checking
daemon@ATHENA.MIT.EDU (Paul L Schmehl)
Wed Feb 9 03:48:58 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <833648163.950021420@pc27233.utdallas.edu>
Date: Tue, 8 Feb 2000 14:50:20 -0600
Reply-To: Paul L Schmehl <pauls@UTDALLAS.EDU>
From: Paul L Schmehl <pauls@UTDALLAS.EDU>
X-To: "Eric D. Williams" <eric@INFOBRO.COM>,
Bugtraq List <BUGTRAQ@SECURITYFOCUS.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <01BF6E9C.3D736730.eric@infobro.com>
I doubt this would work. To introduce a virus into the system, it has to
be loaded into memory as an active program, not just written to disk. As
soon as the virus-infected file/program was launched (and thus became
active), the A/V program should/would detect its presence and alert the
user.
The reason pagefile.sys and recycle bins are not normally included in
default scanning is precisely because in_those_locations a virus is
essentially benign. If one were to try to activate it, normal detection
routines should discover its presence and remove it before any infection of
files takes place.
Furthermore, only pagefile.sys on specific drive letters is excluded from
scanning. So your proposed technique of writing to a non-existant pagefile
would be precisely the same as writing to disk, which is a detectable
activity.
--On 2/3/00, 11:12 PM -0500 "Eric D. Williams" <eric@INFOBRO.COM> wrote:
> Another stab with a little more clarity ---
>
Paul L. Schmehl, pauls@utdallas.edu
Technical Support Services Manager
The University of Texas at Dallas
