Virus signatures

[Stoilis Giannis]

Στις Τετ 12 Σεπ 2001 16:43, γράψατε:
> "Mitso kalispera. Sou stelno afto to mail gia na sou eksigiso giati kathe
> fora pou pas na anoikseis ton explorer sou bgazei error gia to arxeio
> "kernel32.dll". Sta leo ola analitika sto doc pou exo kanei attach."

To mail sou me ebale se skepseis, opote skefthka na to dokimasw kai monos 
mou. Meta apo kapoia problhmata[1], eftiaksa 2 doc arxeia me office 2000, to 
ena elege "mpla kernel32.dll" kai to deutero elege "μπλα kernel32.dll". 
(Hksera apo prin oti ta .doc arxeia pou exoun mesa ellhnika, ta apo8hkeuei me 
diaforetiko tropo)

stoilis at loulou:~ > cd /windows/c/
stoilis at loulou:/windows/c > ls *.doc
1.doc  2.doc
stoilis at loulou:/windows/c > strings 1.doc > 1.txt
stoilis at loulou:/windows/c > strings 2.doc > 2.txt
stoilis at loulou:/windows/c > grep -i kernel32.dll *.txt
1.txt:Kernel32.dll
stoilis at loulou:/windows/c >

Koita, an exeis kanei ena .doc arxeio attach, 8a exei ginei sigoura encoded 
efoson einai binary, opote den uparxei periptwsh na mperdepseis to "kernel32" 
pou einai sto body me to "kernel32" pou einai mesa se kapoio .doc. Apo thn 
allh, sta agglika keimena word, an exeis mia frash mesa pou na anaferei to 
kernel32.dll, tote auto 8a fanei apo to filtro kai 8a probei se la8os 
energeies(an upo8esoume dld oti exeis ftiaksei pragmati ena tetoio filtro gia 
ton mail server sou. An omws, apo thn allh, to arxeio tou einai ellhniko kai 
exei mesa thn leksh kernel32.dll, tote auto 8a ginei encoded me kapoio 
agnwsto microsoftiko tropo kai den 8a fainetai apla me ena grep. Se ena 
molusmeno doc arxeio, akoma kai ellhniko, fainetai to kernel32.dll ka8ara.

> Poli grigora kai proxeira:
> #include <iostream>
Opws anefera kai sto prhgoumeno mail auto einai apla mia me8odos tupou "rule 
of the thumb", apla kai mono gia thn ikanopoihsh ths periergeias mou.[2] 
Efoson xrhsimopoiw mono linux, siga na mhn mpainw apo windows, apla kai mono 
gia na dw an ena .doc einai molusmeno. Giati na mhn ta anoiksw me ena *office 
paketo pou exw, afou outws 'h' allws den pianoun auta sto linux?
Oso gia to HELO, brhka io pou stelnei mail, einai .doc based, alla oute 
mapi32dll exei, oute HELO mesa tou, opote mporoume apla na to parablepsoume 
ws me8odo anagnwrishs molusmenou .doc

[1] Boot Win98, kollane. Ksana boot, anoigw word, save, kollane. Boot, 
problhma sto registry. Boot kai, w 8auma, doulepse[3]

[2] Dhladh den exoun kammia praktikh efarmogh ola auta...

[3] Xesthkate, kserw...


Filika
- Giannis Stoilis