[14214] in bugtraq

home help back first fref pref prev next nref lref last post

Re: NAI/McAfee Viruscan Engine does not scan .VBS files by default

daemon@ATHENA.MIT.EDU (Roy Voortman)
Thu Mar 9 00:53:54 2000

Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii
Message-Id:  <38C67786.344A1ED6@oce.nl>
Date:         Wed, 8 Mar 2000 16:53:42 +0100
Reply-To: Roy Voortman <rvoo@OCE.NL>
From: Roy Voortman <rvoo@OCE.NL>
X-To:         Bram Kerkhof <mcafee-bugs@BUGTRAQ.E-WARENESS.BE>
To: BUGTRAQ@SECURITYFOCUS.COM

Bram Kerkhof wrote:
>
> SYNOPSIS
> The default NAI/McAfee Viruscan Engine configuration does not include
> .VBS in the list of program file extensions, thereby skipping .VBS
> files when scanning. The VBS/Freelink virus and possible other viruses
> could go undetected.
>
> SOFTWARE VERSIONS
> - - McAfee Viruscan NT Engine 4.0.3a
> - - McAfee Viruscan 9x Engine 4.0.3
> - - McAfee Netshield Engine 4.0.3
> - - McAfee Groupshield for Notes Engine 4.50
> remark: These are only the software versions we currently use in
> production. Others may be affected too.
>
<snip>
>
> WORKAROUND
> Two possible solutions:
> - - Add the .VBS extension to the list of program file extensions in the
> on-access monitor, and the viruscan program... Keep in mind that
> different viruscan programs have their own lists!
> - - Select "Scan All Files"
>
Another workaround may be to install the "super-dat" file. This updates
the scan engine to 4.0.50 and includes the VBS-files in the program file
extensions. At least my Winnt 4.0 pc with the latest super-dat file
installed showed VBS in the program file extensions.

Roy Voortman

------------------------------------------------------------
Learn as if you will live forever
Live as if you will die tomorrow
============================================================

home help back first fref pref prev next nref lref last post