[Full-disclosure] Question re: Macro Virus behaviour

[gjgowey at tmo.blackberry.net]

When in doubt use notepad to open the file.  Macro's are still going to show up as plaintext should be fairly easy to then figure out if the file is kosher or not.  If they're not showing up as ascii then I'd worry a bit.  Of course you could also just install AVG and sandboxie to open the file and find out without worrying about if you're going to destroy your machine in the process (I love that about sandboxie).

Geoff

Sent from my BlackBerry wireless handheld.

-----Original Message-----
From: "Kelly Robinson" <caliana1989 at gmail.com>

Date: Sun, 7 Oct 2007 16:05:33 
To:full-disclosure at lists.grok.org.uk
Subject: [Full-disclosure] Question re: Macro Virus behaviour


An MS Word file on your computer has a size of 356 KB and a modified date of 19 June 2007 3:37:51 PM. Moreover, the file has been certified clean (i.e., uninfected) at this point by an infallible AV scanner.  

After a highly-publicised virus outbreak, you examine this file's properties again and notice it is still 356 KB with the same modified date and time. Can you safely conclude it has not been infected without checking it with your AV scanner? 
   
 Why or why not? _______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/