New Anti-Virus Evasion Technique Discovered

http://www.eweek.com/c/a/Security/S...d-Allow-Hackers-to-Dodge-AntiVirus-Detection/

 

Very nice read, TY

 

isn't this sort of thing defeated by things like mcafee's scriptscan or any other scanner that intercepts calls to the scripting engine rather than intercepting network traffic the way a gateway scanner does? i mean, the javascript still gets assembled in the client's memory and then sent to the scripting engine to run - scriptscan and similar technologies should be able to handle that...

further, isn't calling that initial bit of javascript non-malicious a bit of a stretch? it's the javascript equivalent of a downloader trojan... as such there's no reason not to create signatures for it...

 

this is a prime example of why firefox and noscript are indispensable tools

 

that too, but only a minority of us are so protected...