Author Topic: Virus not detected  (Read 8788 times)

0 Members and 1 Guest are viewing this topic.

PapyNet

  • Guest
Virus not detected
« on: October 01, 2004, 12:18:31 PM »
Hello!
I Speak english very very badly.

http://sylvana.net/test/AP4.jpg

IE scratch!


This Dos is not detect by Avast!

Why ?

Bien cordialement
Georges

whocares

  • Guest
Re:Virus not detected
« Reply #1 on: October 01, 2004, 12:52:13 PM »
Hi,

please don't post direct/clickable links to malware here;
at least edit your posting (e.g. replace "http" with "h**p")

KAV says:
AP4.jpg infected by "Exploit.IE.Crashsos"

-> As always, please email the file to virus (at) avast.com
best in a password-protected zip- or RAR-archive
(include problem description and archive-password in the mail-text)


 ;)

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re:Virus not detected
« Reply #2 on: October 01, 2004, 01:08:49 PM »
Actually, I'm not sure if this should be called a virus.
This JPEG does not use the recently discovered exploit (MS04-028) - it is a completely different bug. This one, however, is probably impossible to misuse to execute a malicious code - it can "only" crash the browser.

Of course, it's bad when computer programs contain bugs, but I would automatically call the problematic files (where the bug actually shows up) as viruses ;D
« Last Edit: October 01, 2004, 01:16:16 PM by igor »

PapyNet

  • Guest
Re:Virus not detected
« Reply #3 on: October 01, 2004, 04:20:37 PM »
Hello!

In French, excuse me !


Ce n'est pas un virus mais un DOS

Seuls KAV et NOD32 détectent le malware à l'heure actuelle.

D'après ce que j'ai entendu dire, MS n'envisage pas de patcher avant le prochain OS !

Comme ça n'écrit pas de code et provoque just un DoS, ils considèrent que ce n'est pas une faille !

How do you do ?

Bien cordialement
Georgez

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31079
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re:Virus not detected
« Reply #4 on: October 01, 2004, 04:30:45 PM »
This is not a virus but a DOS (haven't got a clue what he means with that)
Only KAV and Nod32 are detecting this currently (not true, others detect it as well)
What I am trying to say is that MS will not release a seperate fix for this, but will fix it in a next OS. (I doubt this very much)
MS says it is not a fault in their code.

This translation has been made with a very rusty French knowledge so there are likely a few mistakes and it certainly isn't the best translation possible. ;)
« Last Edit: October 01, 2004, 04:32:54 PM by Eddy »

Offline MikeBCda

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2247
Re:Virus not detected
« Reply #5 on: October 01, 2004, 05:48:20 PM »
This is not a virus but a DOS (haven't got a clue what he means with that)
This translation has been made with a very rusty French knowledge so there are likely a few mistakes and it certainly isn't the best translation possible. ;)

Hi Eddy (and of course anyone else in this thread I missed),

My personal guess is that PapyNet means it triggers a denial-of-service attack.  Too bad the standard acronym for that is so similar to the one for the OS, it's totally confused meanings.

Best,
Mike
Intel Atom D2700, 2 gig RAM, Win 7 x64 SP1 & IE-11, Firefox 51.0
(default). 320 gig HD, 15Mb DSL, Win firewall, Avast 12.3.2280 free, SpywareBlaster, MBAM Prem., Crypto-Prevent

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31079
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re:Virus not detected
« Reply #6 on: October 01, 2004, 06:00:51 PM »
Quote
Too bad the standard acronym for that is so similar to the one for the OS, it's totally confused meanings.
Actually it is not the same acronym. Many people call it just denial of service but in fact it is Distributed Denial Of Service (DDoS)

Definition of DDoS:
On the Internet, a distributed denial-of-service (DDoS) attack is one in which a multitude of compromised systems attack a single target, thereby causing denial of service for users of the targeted system. The flood of incoming messages to the target system essentially forces it to shut down, thereby denying service to the system to legitimate users.

A hacker (or, if you prefer, cracker) begins a DDoS attack by exploiting a vulnerability in one computer system and making it the DDoS "master." It is from the master system that the intruder identifies and communicates with other systems that can be compromised. The intruder loads cracking tools available on the Internet on multiple -- sometimes thousands of -- compromised systems. With a single command, the intruder instructs the controlled machines to launch one of many flood attacks against a specified target. The inundation of packets to the target causes a denial of service.

While the press tends to focus on the target of DDoS attacks as the victim, in reality there are many victims in a DDoS attack -- the final target and as well the systems controlled by the intruder.
« Last Edit: October 01, 2004, 06:01:40 PM by Eddy »

lee16

  • Guest
Re:Virus not detected
« Reply #7 on: October 01, 2004, 08:30:14 PM »
Eddy

Don't firewalls stop incoming/outgoing DDos attacks?, is the damage done permanant?

--lee

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re:Virus not detected
« Reply #8 on: October 01, 2004, 08:38:40 PM »
Don't firewalls stop incoming/outgoing DDos attacks?, is the damage done permanant?

Generally, the professional version of them do it.
Outpost Pro could not only block DDoS attacks but even block the 'hacker' IP  ;)
The best things in life are free.

PapyNet

  • Guest
Re:Virus not detected
« Reply #9 on: October 01, 2004, 08:44:11 PM »
Hello!

It'is not a problem to Firewall but Antivirus.
Scratch Internet Explorer.

In French :
Signalé sur le forum private MS MVP  par un expert en Sécurité :

Le DoS dans une image JPEG (AP4) dispo ici : http://sylvana.net/test/AP4.jpg (crash IE en créant un buffer overflow en inscrivant des données dans une zone de mémoire non allouée) est dû au fait qe comme beaucoup MS fonctionne sur le mode "Suivez mes conseils mais pas mes exemples" : IE utilise une bibliothèque pourtant patchée depuis 1998...

Seuls KAV et NOD32 détectent le malware à l'heure actuelle.

Ma question est : que va faire Avast! pour traiter ce problème  ?

Bien cordialement
Georges


Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31079
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re:Virus not detected
« Reply #10 on: October 01, 2004, 08:55:32 PM »
Quote
It'is not a problem to Firewall but Antivirus.
No it is not. It is a problem of the OS not the firewall, nor the AV.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re:Virus not detected
« Reply #11 on: October 01, 2004, 09:20:28 PM »
Once more: the file is not a virus!
The image was created long time ago by somebody who experimented with various possibilities of JPEG format encoding. The fact that Microsoft HTML Viewer library isn't able to display it - and crashes instead - doesn't make it malicious (btw, Netscape 4.x crashes on it badly, too). As far as I know, there is no buffer overflow inside, i.e. no possibility of executing a malicious code.

If some viruses start to send this (or similar) file to people with the intention of crashing their browser/e-mail client, we will consider adding the detection - but still, the file itself isn't a virus, there will have to be another piece of real virus that would send it.

PapyNet

  • Guest
Re:Virus not detected
« Reply #12 on: October 02, 2004, 12:09:57 AM »
Hello!

STOP

Nous ne nous comprenons pas!

STOP STOP STOP

Bien cordialement
Georges

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31079
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re:Virus not detected
« Reply #13 on: October 02, 2004, 02:28:26 AM »
PapyNet, please use the online translator I mentioned in the IM. If that isn't enough to understand, see if you find someone there who can translated English to French for you. I'm sure that will clear up many things for you.

inthewildteam

  • Guest
Re:Virus not detected
« Reply #14 on: October 02, 2004, 03:01:17 AM »
Off topic (sorry)

she is quite cute!

Old pic though and nothing new in hiding info in a picture file.