-1

We have a virus detection event detection in Symantec Endpoint Protection called 'Bloodhound.Exploit.33' that Symantec describes on their page here:

https://www.symantec.com/security_response/writeup.jsp?docid=2005-041215-1512-99

We want to see if Windows Defender (or another Vendor) would have been able to detect this infection if Symantec was not present on host. Over time, we will do it for a bunch of virus / threat detections to justify cost for Symantec.

Is there a way to crosscheck a virus name across different vendors to see if they have its definition in their definition file? I do know about virustotal but they ask for sample binaries that I do not have and would like a way to search by name given by Symantec, e.g. Bloodhound.Exploit.33'.

2

"Bloodhound.Exploit.33" is not the name of a binary, which is why Symantec does not make a hash available.

"Bloodhound" is Symantec's Heuristic detection name and it (Exploit.33) is related to "...detection for the MSN Messenger Crash on Parsing GIFS..." and this was associated with a vulnerability identified in 2005 as CVE-2005-0562. This means that it was found and identified 9 years ago. Therefore the propensity of this vulnerability still being viable and un-patched is extremely small. The fact is the vulnerable software, MSN Messenger v6.2, is now a dead product.

If Norton AV (NAV) is detecting "Bloodhound.Exploit.33", we need to look at WHAT is being flagged as "Bloodhound.Exploit.33".

As for using VirusTotal, uploading a binary is not necessary; one can search via hash, URL, domain, and IP address:

search VirusTotal

When I used VirusTotal to search for the md5sum 9219e2cfcc64ccde2d8de507538b9991, this was the result:

BlackEnergy

Reports and technical write-ups will include hashes of the binary being discussed. The binary I used for this example can be found here (it is definitely not "notepad").

0

If you can get a hash of the virus then you can utilize https://www.virustotal.com/ to find out which vendors are detecting it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.