OT: Inundated with bogus(?) warnings I'm infected

Mikkel L. Ellertson mikkel at infinity-ltd.com
Wed Sep 13 16:00:03 UTC 2006


Matthew Saltzman wrote:
> 
> This is a classic virus/trojan payload technique.  If your mailer
> appears to show the attachment as a .doc file, you might be persuaded to
> open it with MS Word.  The .scr extension is there to get past
> attachment scanners that key on the file type.  Odds are, this is a Word
> macro trojan.
> 
Do, the .scr extension is so that when you try and open it, it is
treated as a screen saver. That way, the code in the file gets run.
What you have to remember is that in Windows, the file extension is
what controls how the file is handled, and spaces in the file name
are allowed. If you shortened the name to text.doc and tried to open
it, it would show up as an invalid or corrupted file. The spaces are
there so you miss the real extension on the file.

Mikkel
-- 

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!




More information about the fedora-list mailing list