Re: [Full-disclosure] Question re: Macro Virus behaviour

[gjgowey@xxxxxxxxxxxxxxxxxx]

When in doubt use notepad to open the file.  Macro's are still going to show up 
as plaintext should be fairly easy to then figure out if the file is kosher or 
not.  If they're not showing up as ascii then I'd worry a bit.  Of course you 
could also just install AVG and sandboxie to open the file and find out without 
worrying about if you're going to destroy your machine in the process (I love 
that about sandboxie).

Geoff

Sent from my BlackBerry wireless handheld.

-----Original Message-----
From: "Kelly Robinson" <caliana1989@xxxxxxxxx>

Date: Sun, 7 Oct 2007 16:05:33 
To:full-disclosure@xxxxxxxxxxxxxxxxx
Subject: [Full-disclosure] Question re: Macro Virus behaviour


An MS Word file on your computer has a size of 356 KB and a modified date of 19 
June 2007 3:37:51 PM. Moreover, the file has been certified clean (i.e., 
uninfected) at this point by an infallible AV scanner.  

After a highly-publicised virus outbreak, you examine this file's properties 
again and notice it is still 356 KB with the same modified date and time. Can 
you safely conclude it has not been infected without checking it with your AV 
scanner? 
   
 Why or why not? _______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/