Hi there, I'm accessing the web right now through a Kerio Winroute Firewall with McAfee protection (transparent proxy). Didn't detect at all while downloading the file. Once the download completed, manual scan with Symantec AV Corporate (8.1 with Client Security and defs. from 13/06/2004 rev. 17) properly detected the eicar test strings and removed the files which means that the realtime protection didn't work since the file was saved locally). But the interesting thing is: I tried to send the file attached as a hotmail message to myself. The rtvscan.exe process started eating up CPU, like it entered a loop of some sort. I left it running for 20 minutes, and had to kill it (the hotmail upload option timed out). Romulo M. cholewa Home: http://www.rmc.eti.br News: http://www.rmc.eti.br/news PGP key id 0x7F8A3B40 ] -----Original Message----- ] From: Bipin Gautam [mailto:visitbipin@xxxxxxxxxxx] ] Sent: Sunday, June 13, 2004 7:33 AM ] To: bugtraq@xxxxxxxxxxxxxxxxx ] Subject: Antivirus/Trojan/Spyware scanners DoS! ] ] ] ] Hello everybody, ] ] ] ] I doubt how many Antivirus/Trojan/Spyware scanners will choak ] to death while having a "manual scan" of this file. Please go ] ahead and give it a try. ] ] ] ] http://www.geocities.com/visitbipin/SERVER_dwn.zip ] ] ] ] I was woundering, what would be the results if such file gets ] stucked in an "AV gateway" (O; ] ] ] ] please, report your findings..... I have already been ] bombarded with strange reports. ] ] ] ] regards, ] ] ] ] Bipin Gautam ] ] http://www.geocities.com/visitbipin/ ]
