mailing list archives
Antivirus detection after malware execution
From: "jason () n00bz net" <jason () n00bz net>
Date: Mon, 18 Oct 2010 14:58:31 -0700
The purpose of this writeup is to detail the execution of malicious code
via a protocol handler (hcp) prior to being
detected by Anti-Virus Technology. It should be noted that detection does
occur by AV however only after the code is
executed and placed into memory.
Using this technique, an attacker can effectively bypass the protections
of AntiVirus technology. Being able to bypass
AntiVirus technology allows an attacker to drop and execute known
malicious files (Zeus for example).
The exploit used to trigger this behavior is CVE-2010-1885 (HelpCenter)
released by Tavis Ormandy. While this exploit
is used, this is NOT a rehash of the Microsoft Helpcenter Exploit. The
purpose of this write up is to walk though the
discovery and document the method used to effectively bypass AntiVirus and
execute a malicious payload on a victims
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Antivirus detection after malware execution jason () n00bz net (Oct 19)