Trojan horse Downloader.Generic.ML

That was a quote. Ask Zvi.

Guess again.

NO, AVG is my expert. AVG flagged it. AVG may have detected virus like activity and/or now considers THAT file to be a nasty. AVG's report/flag IS the evidence. The is no evidence that AVG made an error. In fact all the evidence suggests that AVG performed admirably.

Ron is quoting me, in message :

After explaining why the flagging of C:\\null by AVG as Qdown.s is a false positive, I added: "Lastly, the NULL file isn't benign from its content. But it isn't the real thing either, ..."

On hindsight, I should have used "ambiguous" or "probably not innocent" rather than not benign. What called for that observation is the cumulative weight of the followings:

- The sample contains explicit reference to a file named "NULL".

- The sample contains reference to the Wininit procedure, in the same context. This procedure is normally used in early Windows versions for completing pending tasks during Windows startup, and couldn't execute when Windows was still running, like software installation or removal.

- There is reference to a DLL named QDOWAS2 in the sample. The similarity of the file name to Qdown, the Trojan that some scanners suggest it is, didn't seem accidental to me.

I tend to agree with Ron, that the smoke is from a gun, but he failed to produce evidence that will help exposing that gun. Without it, what we have is nothing more than the evidence that there were WMD in Iraq on the eve of the second Gulf War. What we need is info on what creates the NULL file and how, and the way to obtain it is by replicating its creation, under controlled conditions. Instead, Ron is wasting his time (and ours) in reiterating already exhausted evidence.

For the moment, this thread is leading nowhere, and going in circles.

Regards, Zvi

-- NetZ Computing Ltd. ISRAEL

You certainly fooled me. I see now that I misunderstood your original post. Quoting from:

"So where and how did this file C:\\NULL that AVG claims is Trojan horse Downloader.Generic.ML appear from? Was it really there since 5/5 but went unnoticed ... OR did something penetrate all the firewalls and suddenly spawn this file ... What likely happened here?"

Speaking of consistency and logic ... ;-)

Regards, Zvi

-- NetZ Computing Ltd. ISRAEL

report/flag IS

Precisely, exactly. All that confirms my position from the beginning. All your posts seem to confirm the fact that there's substantial evidence that AVG reported at least the smoke of the smoking gun. Ergo the claim that there was some completely false positive report is grossly misleading. The evidence is that AVG reported a true positive.

not to the best of my knowledge, no...

??? we're talking about cracking wep security and thereby rendering all supposed 'encrypted' traffic easily viewed in plaintext form...

if your wireless access point is using wep security then there's the vulnerability right there... does it allow a cracker to gain access to your system? perhaps not... does it allow a cracker to read all your network traffic in an unprotected form? yes, yes it does...

not all security breaches result in system penetration...

while it's true that there isn't exact consensus on the definition of trojan, this isn't anywhere near where attempts at consensus were going...

"trojan" is a short form of "trojan horse program"... therefore roger is correct to say that trojans are programs...

so data diddlers don't exist?

what i said is technically correct... malware *can* make arbitrary changes - there may not yet be a malware instance that changes bytes X, Y, or Z in a file but there's nothing preventing one from being made...

there is malware the corrupts and/or destroys data - you can contest the existence of such malware if you like, but you'd be tilting at windmills...

actually, i don't think they are the same thing... i don't believe users are incapable of such, i believe they are unwilling...

sophos used propaganda to justify being a less attractive option? that really doesn't make a whole lot of business sense... you (the general you) can't claim that action X can't be done satisfactorily so you won't do it and expect potential customers to accept that when most other vendors provide products that do perform action X...

you can't recover overwritten objects merely from an integrity fingerprint...

i was not pointing at you... i was merely stating a preference... while i can recall plenty of things you've said that i disagreed with, i can't recall you directly saying anything that was blatantly snake-oil...

i'm afraid i'm not yet convinced of that...

You forget that a virus can *replicate* the functionality of a program without keeping it, in which case there's nothing to revert back to. This is most certainly true for most boot virus, and also some file virus do this.

Or disinfection where the original is not retained at all.

The problem is with the word "nearly". Just for fun, place the eicar test string in an NTFS or XFS stream for a file, and see how many "properly implemented" real time integrity monitors will catch it. Or do a prelink/requickstart of executables and libraries and see how many of the monitoring programs that will go nuts because the files have changed.

(So far I know of only *one* AV product that breaks down a file into different hunk types and only scans the relevant bits. And it doesn't do monitoring. And only *one* product that checks streams, and it's not an AV product, but an anti-spyware product.)

Regards,

We seem to have a severe case of [mis] comprehension here.

Exactly what? Were your questions answered? If yes, then would you mind sharing that information with the rest of us?

Regards, Zvi

-- NetZ Computing Ltd. ISRAEL

But now we are starting to see so-called Warhol worms with destruction triggered at peak population. Were talking malware here not just viruses. [snip]

I just knew that "overwriters are not viruses" would be revisited, but at least it isn't me this time.

For those that might be interested, here's this from:

(a very good read technically - I found the English a little "bumpy" though)

Definition 4.1.: A computer virus is defined as a part of a program which is attached to a program area and is able to link itself to other program areas. The code of computer virus has to be executed when that program area is to be executed which the virus has been attached to.

Viruses have not to execute the original part of the program area, but the viruses often do it because they want to be unobserved. In this case the original part of the program area has to be repaired by the virus. In the opposite case the virus may overwrite the program area thus the virus destroys it.

The definitions of "virus", "worm" and "trojan" are often tailored to the specific needs of the area of technology the expounding person inhabits. IMO this "Mathematical Model of Computer Viruses" should be the thread their "virus definition" fabric is woven from. If the need arises (and it apparently has) to create a dichotomy between viruses with "reversible virus infection methods" to those with "irreversible virus infection methods" and futher with those with "neuterable virus infection methods", then they should define new words to describe them and not redefine existing words.

I'm wondering if ISPs are starting to crack down on the use of wireless. There seems to be a lot of "freeloading" going on, for one thing, where wideband customers are allowing their friends nearby to share their ISP service. Plus, crackers with high gain antennas may be able to freeload wideband services from various nearby sources with a bit of additional detective work.

And it seems to me that hackers could glean enough info to penetrate many "typical user" unsecured systems.

Art

I knew Sophos did from a whitepaper by them I had read. Others' I wasn't so sure about. They could still use extension based exclude lists for the control program (don't even look at files named *.txt, pagefile.sys...) but it makes me wonder whether files with extensionless filenames can hide from other security schemes this way. I have only seen 'include' lists with reference to filetype blocking (when someone asks what filetypes by extension he or she should be concerned with allowing in by for instance e-mail).

malware

That's what I thought, thanks.

The on-access (and to some extent the on-demand) should not be telling you "this may contain this or that" but rather that "you might not want to execute this because this or that may execute as well" - if it is non-executable then there would be no point in warning about the possible consequences of executing it. If people want to know if a threat will exist if they extract and execute the contents of a container or text file , that would be fine for an on-demand option but might be a problem for on-access. The advent of malformed archive file exploits could have used this on-accesslike e-mail scanning functionality to auto-spread. Why do such an unneeded thing when it increases complexity and hence risk.

??? You're saying they can't drop customers using wireless? Why not? It would be a somewhat difficult business decision to make, but I see nothing to stop them if they decide to head in that direction.

Art

How would they do that?

HINT: They cannot.

If you are talking about ISPs giving out broadband access via wireless you are correct. The topic however was about people cracking wireless access points, routers etc so I assumed you were talking about. (ie. people on ADSL/DSL/T?/E? wired connections sharing out using an AP) If so then yes I am saying its impossible to stop customers using wireless.

Why?

Art