Antivirus: July 2005 Archives

I've been seeing a couple of viruses detected heuristically in the inbound email at my company.

Subject: Finally!
Subject: Finally! Captured!
File: pics.scr (could be inside a zip)

Fsecure has a mention in their blog that seems to match what I"m seeing. They call it bobic.d

This presentation was given earlier, but its worth mentioning again. At Blackhat this year there was a demo on owning systems through antivirus. It was more of a history lesson of the ISS discoveries which allowed remote code execution via many antivirus products.

http://blackhat.com/html/bh-usa-05/bh-usa-05-speakers.html#wheeler

I went to Symantec's Fileconnect site and they actually had the latest version of symantec available. 10.0.1.1000. Amazing. Downloading now. Tomorrow, I'll remote 10.0.0.359 from my test server and try out 10.

I'm sure the airing of the grievances will come after I install the software. :)