Administrivia: strange windows behaviour.

[Dan Hanson <dhanson () securityfocus com>]

Hi all,

This thread, up till this point, tied back into active incidents,
and their investigation, this is now travelling off topic for the
incidents list, and this particular direction of inquiry might be more
applicable on the focus-virus () securityfocus com list.

I am not killing this whole thread, as the actual observed behaviour
hasn't been fully explained, and there are corrobarating reports.


On Thu, 9 Oct 2003, Harlan Carvey wrote:

> Paul,
>
> > There's been a lot of discussion about this amongst
> > av professionals.
> > There's really no advantage to scanning streams
> > because they are
> > "inert".  In order for the trojan to do anything, it
> > has to "come out of
> > hiding" as it were, and when it does, av on access
> > scanning will detect
> > it **if it's a known trojan**.  While it's in the
> > stream it's merely in storage, not being used.
>
> Can you elaborate on "has to come out of hiding"?
> I've repeatedly demonstrated how an executable can be
> written to an ADS and launched directly from that
> location, without having to be copied to another
> location, such as a temp file.  The same is true on
> Win2K systems and above with VB and JavaScript files.
>
> Thanks for anything you can provide.
>
> Harlan

---------------------------------------------------------------------------
----------------------------------------------------------------------------