eScan Antivirus Database Sabotage via ODS Registry Modification

S@1@N .@kohtet

•updated Feb 2, 2026•1•29

Detects modification of eScan antivirus database-related registry values, such as setting WTBases_new to an abnormal value (e.g., 999) under the ODS registry key. This behavior may prevent signature updates or force the antivirus engine into an inconsistent state.