thefantom1 said:
Dillon........for the average person though I think it is valuable.. how many newbies on computers do any of the stuff you mentioned??? Zero So for the average undisciplined computer user I think they are a viable and usefull tool............
Your right!
Here is an example of an exploit
Norton Antivirus 2002 Security Flaws
Summary
Norton Antivirus has a quarantine area feature, where the quarantine area is used to store viruses that the program has found until the user/administrator decides what to do with them. Usually the configuration settings for this feature are password protected, but this password protection can be easily broken due to two problems in the product.
Details
The first problem is the weak password scheme Norton Antivirus Quarantine uses.
1) Symantec uses hexadecimal characters table conversion to encrypt the password. Converting the hex into dec and looking into an appropriate ASCII table will give you the right letter. Here is such a table:
a 41 b 42 c 43
d 44 e 45 f 46
g 47 h 48 i 49
j 4A k 4B l 4C
m 4D n 4E o 4F
p 50 q 51 r 52
s 53 t 54 u 55
v 56 w 57 x 58
y 59 z 5A
0 30 1 31 2 32
3 33 4 34 5 35
6 36 7 37 8 38
9 39
ALT+255 A0 Space 20
2) You can easily bypass the password protection by disabling it. Open 'QuarOpts.dat' with notepad (or anything else) and set the value of "ENABLED=TRUE" into "FALSE". This would allow you to configure the Quarantine without knowing the password.
The second problem is that the Norton Antivirus service can be easily deactivated. When Norton AntiVirus 2002 is installed on a Windows NT/2000 operating system a new service will be added, the service is called 'Norton AntiVirus Auto Protect Service'. This service automatically will start the 'Norton Antivirus AutoProtect Service' upon every Windows startup. The startup method can be modified by changing one value in the registry.
The key is found at:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\navapsvc
Changing the value of the DWORD 'Start' to any of the below values will change the behavior
2 = (default) automatic startup
3 = manual startup
4 = startup disabled
Exploit:
The following script will change the Norton Antivirus startup service status to disabled.
<< ============================== disable_start.js ============================== >>
var WSHShell = WScript.CreateObject("WScript.Shell");
WSHShell.RegWrite("HKLM\\SYSTEM\\CurrentControlSet\\Services\\navapsvc\\start", 2, "REG_DWORD");
<< ============================== disable_start.js ============================== >>
There are many many more exploits than this, but it's up to the vendor to try and fix these problems.
There is a trojan called DatKiller This file corrupts .dat files thus rendering Norton and Mcafee virus scanning products lame and useless. It will now auto-restart upon reaching desktop so reinstallation of the antivirus software is useless now. This program is very dangerous and can be downloaded by anybody off the net, nothing is safe i don't care what anybody tells you.
Please Scroll Down to See Forums Below 
