Virus Bulletin - November 2005

Editor: Helen Martin

Technical Consultant: Matt Ham

Technical Editor: Morton Swimmer

Consulting Editor: Ian Whalley, Nick FitzGerald, Richard Ford, Edward Wilding

2005-11-01

Abstract

Is the boot on the other foot? (comment); Criss-cross (virus analysis); IME as a possible keylogger (feature); The false positive disaster: anti-virus vs. WinRar & co. (feature); In Dublin’s fair city (conference report); NOD32 for Windows NT/2000/XP/2003/x64 with centralized management (product review)


Comment

Is the boot on the other foot?

It adds insult to injury when the major media outlets misrepresent the facts.

Gabrielle Dowling - Independent author, USA


Virus analysis

Criss-cross

Cross-infector viruses demonstrate the flexibility of certain file formats. While some of these viruses have clearly been written to maximise their replication potential, most seem to have been written simply to show that it can be done. Peter Ferrie takes a look at three of the latest Cross-infector viruses on the scene

Peter Ferrie - Symantec Security Response, USA


Features

IME as a possible keylogger

Using components of Windows multilingual support, it is possible to create a file that will capture keystrokes on a target system while using the OS to protect that file from removal or deletion. Masaki Suenaga explains how an IME could be used as a keylogger.

Masaki Suenaga - Symantec Security Response, Japan


The false positive disaster: Anti-Virus vs Winrar & Co

Andreas Marx reports on his extensive false positive testing of anti-virus software.

Andreas Marx - AV-Test.org, Germany


Letters

In response to review comments

Kaspersky's David Emm comments on the KAV 5.0 writeup from last month's comparative review. Virus Bulletin's Matt Ham responds.

David Emm - Kaspersky Lab, UK


Conference report

In Dublin's fair city

VB2005 was a double record breaker - Virus Bulletin's longest and largest conference to date. We were delighted to welcome well over 360 delegates to The Burlington hotel in Dublin for the debut of the event's new longer format - and, for the second year in a row, the conference was described by delegates as the best VB conference they had attended.

Helen Martin - Virus Bulletin, UK


Product review

NOD32 for Windows NT/2000/XP/2003/X64 with centralized management

Matt Ham Reviews the latest offering from Eset - NOD32 for Windows NT/2000/XP/2003/X64 with centralized management

Matt Ham - Virus Bulletin, UK


Quick Links

Poll
Does your company allow you to use a personal laptop/mobile device to access company resources?
Yes, it's allowed
Yes, it's actively encouraged
No
I don't know
Leave a comment
View 2 comments

Jobs Recruit Sidebar

VB100 certification
VB100 As expected, the annual VB100 test on Windows XP was an epic. A higher than usual pass rate was tempered by numerous stability issues with the products under test, prompting the unveiling of a new stability rating system. John Hawes has all the details.
See full results.

Virus Bulletin currently has 225,304 registered users.