When I am logged in as Admin and try to replace NDIS.SYS, Windows File Protection replaces it. Why did WFP fail to protect the file against Cutwail in the first place, and how can a virus replace NDIS.SYS using Administrative privs, if I cannot do it myself when Administrator?
You can't blame anyone for your incompetence, WFP is there to keep your system running, not acting as an antivirus (today many people seem to think that antiviruses should be put everywhere, starting from web browsers themselves!) If memory serves me right, in your case you just had to delete the file from WFP cache folder and then the real file. The worst thing to you would be a 5 min search on Google. Lastly, sure the system (might) be unbootable, but where's the virus? You can boot into MS Recovery console and repair your system (missing driver etc) but you can't do an antivirus scan reliably from recovery console; for one thing such functionality is not available and another, antivirus can't determine certain kinds of virii since they need to be at least loaded (if not running) (example; MSI VBS-generic/self-mutating). Cheers. On Sun, May 23, 2010 at 9:43 PM, lsi <[email protected]> wrote: > On 23 May 2010 at 23:57, webDEViL wrote: > > > All said and done, that doesn't make it a vulnerability. > > Tell that to my customer (wait until I've invoiced them, though). > > Stu > > --- > Stuart Udall > stuart [email protected] net - http://www.cyberdelix.net/ > > --- > * Origin: lsi: revolution through evolution (192:168/0.2) > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
