Re: [Full-Disclosure] Undetectable Virus from CANADA ISP 69.197.83.68

[devis <devis@xxxxxxxxxxx>]

Well its the good old trick <string>.<good known extension>[ insert 
numerous spaces here ].<nasty executable extension>

This relies on MS IExplore or Outlook to not show more than X characters 
of the file name, but as your  screen shots show, its detected as a 
Screen saver meanijng it has a .scr extension which happens to be 
executable as well.

$ file details/details.txt\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ 
\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ 
\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ 
\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ 
\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ .scr
MS-DOS executable (EXE), OS/2 or MS Windows

Does that tricks Hotmail / Mc Afee every time ?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html