On Sat, 2005-02-05 at 13:20 -0500, Paul Laudanski wrote: > Are you finding that certain AVs are not actually checking the contents of > the tarballs? I find in using nod32lms it does deep dive and checks each > file. Please note that one must configure the nod32.cfg file to permit > opening tarballs and other archives for inspection.
I didn't configure the AV's I didn't fancy installing all of them and thought virus total would give a good indication. It appears from the virustotal results and from http://www.nod32.com/products/nt.htm that nod32 will scan and detect tar.gz's but not bz2's. This is the most common result and could be argued to be valid by the vendors. However you can open tar.bz2's on windows so it's still a valid infection vector, although probably not all that useful for viruses. I don't believe many users will go googling for the tools needed. Nonetheless at least a few of the vendors think it's necessary to go beyond the common zip and rar. -- With Regards.. Barrie Dempster (zeedo) - Fortiter et Strenue blog: http://zeedo.blogspot.com site: http://www.bsrf.org.uk [ gpg --recv-keys --keyserver www.keyserver.net 0x96025FD0 ]
signature.asc
Description: This is a digitally signed message part
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html