full-disclosure - Re: Question re: Macro Virus behaviour

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1622770416-1191754187-cardhu_decombobulator_blackberry.rim.net-1135053386-@bxe006.bisx.prod.on.blackberry>
Date: Sun, 7 Oct 2007 10:49:28 +0000
From: gjgowey@....blackberry.net
To: "Kelly Robinson" <caliana1989@...il.com>,
	full-disclosure-bounces@...ts.grok.org.uk,
	full-disclosure@...ts.grok.org.uk
Subject: Re: Question re: Macro Virus behaviour

When in doubt use notepad to open the file.  Macro's are still going to show up as plaintext should be fairly easy to then figure out if the file is kosher or not.  If they're not showing up as ascii then I'd worry a bit.  Of course you could also just install AVG and sandboxie to open the file and find out without worrying about if you're going to destroy your machine in the process (I love that about sandboxie).

Geoff

Sent from my BlackBerry wireless handheld.

-----Original Message-----
From: "Kelly Robinson" <caliana1989@...il.com>

Date: Sun, 7 Oct 2007 16:05:33 
To:full-disclosure@...ts.grok.org.uk
Subject: [Full-disclosure] Question re: Macro Virus behaviour

An MS Word file on your computer has a size of 356 KB and a modified date of 19 June 2007 3:37:51 PM. Moreover, the file has been certified clean (i.e., uninfected) at this point by an infallible AV scanner.  

After a highly-publicised virus outbreak, you examine this file's properties again and notice it is still 356 KB with the same modified date and time. Can you safely conclude it has not been infected without checking it with your AV scanner? 

 Why or why not? _______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/