Re: ISPs can easily decrease net abuse

Article View: comp.security.misc

Article #1084

Back to comp.security.misc Previous Next

#1084

From: Laurent
Date: Thu, 04 Dec 2003 13:24

30 lines
3073 bytes

Lucas Tam wrote:
> Hmmm, never been infected... actually it hasn't bothered
> me.  I keep Norton AV updated and run Windows Update on a
> regular basis.

Funny story. I've lost a substantial worth of workhours because of a
virus/trojan that either I, or someone on our lan got. The funny part is
that I *have* an up-to-date Norton antivirus, and an up-to-date AVG
antivirus as well (testing both). I also tried McAfee's up-to-date free
webscan. None of them detected the trojan. Only I was able to detect it,
the obvious randomly named .exes everywhere in the registry's
Run/Runservices, it's a dead giveaway.

Anyway I sent samples to Norton for analysis, they responded with "this is
trojan blahblah, please download our beta definitions". The beta
definitions indeed got me cleaned.

Guess what? A week later, all of the available antivirus still sees *NADA*
on this trojan. (I kept it in a zip file for tests).

So really, antivirus software are crap when you're not a high-paying
corporate user. SUuuuuure the corporate editions of all these products must
detect this trojan. But not the consumers versions yet. Maybe in a week? If
it were a bigtime virus like say, "Melissa", all mediated and all, it'd be
detected within minutes. But a lowprofile trojan that doesn't destroy
files? I'm left helpless.

Frankly, i've lost respect for antivirus companies.

Laurent

Technical Details

Message-ID: <0AGzb.11949$zf2.1399116@news20.bellglobal.com>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!newsfeed2.dallas1.level3.net!news.level3.com!crtntx1-snh1.gtei.net!news.gtei.net!newsfeed1.easynews.com!easynews.com!easynews!sjc72.webusenet.com!sjc70.webusenet.com!news.webusenet.com!nf3.bellglobal.com!nf1.bellglobal.com!nf2.bellglobal.com!news20.bellglobal.com.POSTED!not-for-mail

References:

<Xns944467F028317jbuserspc9org@130.179.16.24> <0TTyb.118354$Fv8.114900@twister01.bloor.is.net.cable.rogers.com> <TV0zb.4834$yd.916202@news20.bellglobal.com> <Xns9445BA3CE6FDDjuergennieveler@nieveler.org> <bqij1q$q97$1@canopus.cc.umanitoba.ca> <Xns9445C2A53654juergennieveler@nieveler.org> <Xns9446558235E10nntprogerscom@140.99.99.130> <Xns9446CDDE0630Ejuergennieveler@nieveler.org> <Xns9446EB237E5Anntprogerscom@140.99.99.130>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10c8f2,17f958067a510d3b
X-Google-Attributes: gid10c8f2,public
X-Google-Thread: ff723,17f958067a510d3b
X-Google-Attributes: gidff723,public
X-Google-ArrivalTime: 2003-12-04 05:39:28 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!newsfeed2.dallas1.level3.net!news.level3.com!crtntx1-snh1.gtei.net!news.gtei.net!newsfeed1.easynews.com!easynews.com!easynews!sjc72.webusenet.com!sjc70.webusenet.com!news.webusenet.com!nf3.bellglobal.com!nf1.bellglobal.com!nf2.bellglobal.com!news20.bellglobal.com.POSTED!not-for-mail
From: "Laurent" <laurent@faked.mblelop.com>
Newsgroups: comp.security.misc,can.internet.highspeed
References: <Xns944467F028317jbuserspc9org@130.179.16.24> <0TTyb.118354$Fv8.114900@twister01.bloor.is.net.cable.rogers.com> <TV0zb.4834$yd.916202@news20.bellglobal.com> <Xns9445BA3CE6FDDjuergennieveler@nieveler.org> <bqij1q$q97$1@canopus.cc.umanitoba.ca> <Xns9445C2A53654juergennieveler@nieveler.org> <Xns9446558235E10nntprogerscom@140.99.99.130> <Xns9446CDDE0630Ejuergennieveler@nieveler.org> <Xns9446EB237E5Anntprogerscom@140.99.99.130>
Subject: Re: ISPs can easily decrease net abuse
Lines: 32
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Message-ID: <0AGzb.11949$zf2.1399116@news20.bellglobal.com>
Date: Thu, 4 Dec 2003 08:24:59 -0500
NNTP-Posting-Host: 65.92.151.121
X-Complaints-To: abuse@sympatico.ca
X-Trace: news20.bellglobal.com 1070544252 65.92.151.121 (Thu, 04 Dec 2003 08:24:12 EST)
NNTP-Posting-Date: Thu, 04 Dec 2003 08:24:12 EST
Organization: Bell Sympatico

Reply to Parent Message