Full Disclosure mailing list archives
Re: Mydoom
From: Nick FitzGerald <nick () virus-l demon co uk>
Date: Wed, 28 Jan 2004 11:09:01 +1300
Vlad Galu <dudu () diaspar rdsnet ro> wrote:
"Ferris, Robin" <R.Ferris () napier ac uk> writes: | |Does any one know what the size of the attachment is when is comes in |as a zip file? It's the <compressed size>/<ratio>.
Admit it -- you're just guessing! Mydoom makes its zip form by gluing together a .ZIP header for a single, stored (i.e. not compressed) file, the whole of the virus binary and a suitable one-file .ZIP central directory. As the size of the first and third components depends on the length of the filename, the .ZIP is not of constant size because Mydoom uses different length filenames. And, as I explained earlier, even the size of the .EXE can vary, adding yet another inconstancy to the equation. -- Nick FitzGerald Computer Virus Consulting Ltd. Ph/FAX: +64 3 3529854 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Mydoom Ferris, Robin (Jan 27)
- Re: Mydoom Thorolf (Jan 27)
- Re: Mydoom Nick FitzGerald (Jan 27)
- RE: Mydoom jsklein (Jan 27)
- RE: Mydoom Nick FitzGerald (Jan 27)
- RE: Mydoom madsaxon (Jan 27)
- RE: Mydoom Nick FitzGerald (Jan 27)
- RE: Mydoom Nick FitzGerald (Jan 27)
- Re: Mydoom Brent J. Nordquist (Jan 27)
- Re: Mydoom Vlad Galu (Jan 27)
- Re: Mydoom Nick FitzGerald (Jan 27)
- Re: Mydoom Geoincidents (Jan 27)
- Re: Mydoom Nick FitzGerald (Jan 27)
- Re: Mydoom Rob, grandpa of Ryan, Trevor, Devon & Hannah (Jan 28)
- Re: Mydoom Tal Kelrich (Jan 29)
- <Possible follow-ups>
- RE: Mydoom Remko Lodder (Jan 27)
- RE: Mydoom Nick FitzGerald (Jan 28)