netcat on boot?

Quote:

---

Originally posted here by Tedob1
NetCat is neither a trojan or a virus. these AV's shouldn't detect it. it has too many practical uses.

---

You'd think so...

Let's just say that symantec is really dropping in popularity with me... I never liked them because their software is a resource hog... Then they ditched LC5 on us... and of course there's this

http://securityresponse.symantec.com...ol.netcat.html

Quote:

---

Type: Hack Tools

Name: NetCat
Version: n/a
Publisher: n/a

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP


Risk Impact: Low

---

Quote:

---

Behavior
Hacktool.NetCat is a tool for transmitting data across network connections and may allow unauthorized access.

---

Quote:

---

The following instructions pertain to all Symantec antivirus products that support security risk detection.


Update the definitions.
Run a full system scan.

---

So... they shouldn't detect it.. but they do..

Check out their list.. -- http://securityresponse.symantec.com...ex/indexH.html

How long since 7th Sphere was a commonly used IRC Script... yet the port scanner that came with it is there... yes it's just a port scanner... Super Scan is there... everyone knows that name... how about THCScan (a great little app)... and PWDUMP (which is just fun)... Symantec detects a lot of security software that shouldn't be detected...

Peace,
HT

Yes I certainly agree with the resource angle. It has become progressively more complex and demanding with each new release, almost forcing people to upgrade their kit.

I notice that this only applies if you have the security risk detection facility. In this respect it is probably correct as these legitimate tools could be used for malicious acts.

I suppose you would have to put all your tools in a separate partition or folder and instruct Norton not to scan it, much the same as you would do with a malware collection. Then, if it did find something, you would know that it was where it shouldn't be, and investigate.

The reason I mentioned A-Squared earlier is that it is supposed to detect security risks (it is an optional scan) and I wondered how it would react.

:)

HT i stand corrected! im glad your awake.

old man i'd be interested in seeing your findings. please post them when your done.

If I ran an AV scan one day and it picked up NetCat and it was not meant to be there, I think I would be quite glad!

Quote:

---

Originally posted here by Nokia
If I ran an AV scan one day and it picked up NetCat and it was not meant to be there, I think I would be quite glad!

---

You say that now... but think about it.... so netcat has a malicious use...

So does sshd, telnetd, ftpd, hell even httpd... Would you like your AV to start removing any service found running on your computer? Because if they're running legitimately you're going to be quite upset..

Why stop there... Why not remove MP3s since Sony BMG would like to see them gone... or parses all images on your computer and remove anything that has flesh tones in it because they could be porn and then they could be child porn....

This is why some AV software is becoming so bloated... Why can't it just be AV... We know viruses are malicious... so remove viruses... we know worms are malicious so remove worms...

I've seen AV detect VNC... I've seen it detect NetCat... it shouldn't be detecting this stuff... sure it _COULD_ be malicious.. but too ****ing bad.. if I'm properly firewalled/nat'd it won't matter anyways...

I'd rather have AV that does what it's supposed to do than removes half my legit software... What if you worked in the Network Services department for a company and it came down from Management that you had to have 'security risk detection' enabled and auto-delete on and that was pushed from the global config.. and everything HAD to be scanned (less USB Drives.. unless they are connected at time of scan)... that makes your life that much harder... for no reason...

AV companies need to stick what they do... you say you're glad now until it gets to the point where half your stuff has disappeared...

Peace,
HT

Quote:

---

Symantec detects a lot of security software that shouldn't be detected

---

No, it detects potential sercurity risks. If you found any of that stuff on a user's machine I can hardly imagine you would be best pleased. :D

Quote:

---

sure it _COULD_ be malicious.. but too ****ing bad.. if I'm properly firewalled/nat'd it won't matter anyways

---

Oh yes it would!...................you would want to know how it got there...............it could well be an indication of an internal security/discipline problem. ;)

Quote:

---

What if you worked in the Network Services department for a company and it came down from Management that you had to have 'security risk detection' enabled and auto-delete on and that was pushed from the global config.. and everything HAD to be scanned (less USB Drives.. unless they are connected at time of scan)... that makes your life that much harder... for no reason..

---

Actually it makes your life that much easier......................you go and get a proper job with a real company.

Hey, don't go blaming the software concept, when the problems you are describing relate to deployment.

:D

Quote:

---

Originally posted here by nihil
No, it detects potential sercurity risks. If you found any of that stuff on a user's machine I can hardly imagine you would be best pleased. :D

---

Then the question is why do your user have permission to be putting that stuff on their machines.... so it goes down to policies... The software is AV software.

Quote:

---

Oh yes it would!...................you would want to know how it got there...............it could well be an indication of an internal security/discipline problem. ;)

---

Perhaps in a Corporate environment... but in that case I was talking about my home systems... no internal security problems here.... AV Should stick to AV plain and simple..

Quote:

---

Actually it makes your life that much easier......................you go and get a proper job with a real company.

---

That doesn't make life simpler.. that leads to the job hunt and maybe I like the position.. it's one stupid policy...

Quote:

---

Hey, don't go blaming the software concept, when the problems you are describing relate to deployment.

---

The problem is that the software concept is AntiVirus... they're expanding beyond the concept of the software.. so it's not a deployment problem.. it's a creeping problem... the software is creeping into other areas.. Stop labelling it AntiVirus and label it as a File System Security solution... it finds all viruses, trojans and worms... all malware and then anything that _COULD_ be used in a malicious manner.. but as I said.. 1000s of pieces of software _COULD_ be used maliciously... why has Symantec decided to only pick a few of them.... Why not all of them... That's worse than no coverage because it's a false sense of security.

Peace,
HT

I'm with HT here....

AV is _AV_.... Stick to it and do it properly... They are getting so diversified now that they lose the war against the virus writers that watch their sig files and immediately send out variants... Find the damn viruses... Let someone else look for spyware, rootkits etc... or stop calling yourself Anti-virus... Call yourself "Looking for everything but no frigging good at finding anything"... That, at least, is honest!!!!

Hey Tiger~ that is just wishful thinking, and you know it.

Norton and McAfee have been following this route for some time and pulling a few of the others with them. That is the way it will go and they won't turn back.

Can't say I would even consider them for home use these days.

Still, the issue of identifying security risks is interesting, as it is bound to produce false positives unless you are careful where you keep them and don't scan there.

As for automatic deletion, I am always wary of that. You are destroying the "evidence" as well as any "false positives"

As for what gets detected or not, that really is a no-brainer. Stuff that is free is in, stuff that costs a lot of money is out? :D .....................not that I am cynical or anything?

;)