Re: Bagle remover + Nessus 2.2

[Marc Croteau]

I would prefer the second solution. Nessus is a *scanner*. I use it regularly when performing vulnerability assessment for various customers. If it now starts to modify things as it runs, I will have to find another tool. The purpose of a scanner is to scan, not interfere. To answer Renaud's question about the Nessus 2.2 client, I'd prefer if it stayed compatible with GTK 1.2. I recently tried to install GTK 2 and got into all sorts of issues. There are tons of things to install before you can get anywhere (png, jpeg, tiff, pango, ...). I just installed QT3 because it is required to compile the 2.6 kernel with make xconfig. I don't know yet what it's worth but it took a while to compile, seems to take quite a bit of disk space and it also seems to be a product you need to pay for. Are there any other alternatives ? -- Marc ----- Remove the dots to answer or reply to group Renaud Deraison wrote: On Wed, Jan 21, 2004 at 05:03:11PM -0500, Thomas Reinke wrote: The recent bagle_remover.nasl script sets a somewhat dangerous precedent, IMHO, of crossing the line from vulnerability detection to remediation. Not to mention that you are trusting the bagle remover script to do its own removal cleanly. There are a number of reasons why this is bad, not the least of which is that I personally would not trust a virus to remove itself cleanly to begin with. It is by definition, after all, untrusted code. I raised the description level to security hole, and put the script in the DANGEROUS family. However I don't really see what the issue is - the remote host is infected by a virus which has a backdoor listening on it. You have the choice of either: - Disabling that virus and notify the owner of the machine or - Notify the owner and let the virus spread itself -- Renaud _______________________________________________ Nessus mailing list [EMAIL PROTECTED] http://mail.nessus.org/mailman/listinfo/nessus

_______________________________________________
Nessus mailing list
[EMAIL PROTECTED]
http://mail.nessus.org/mailman/listinfo/nessus