Yesterday I mentioned that McAfee quarantine files on Windows (.BUP extension) are actually OLE files.
Im going to write a couple of diary entries highlighting some file types that are OLE files, and I" />
As you can see, this quarantine file contains two steams: Details and File_0. Details is the McAfee anti-virus report, and File_0 is the quarantined file. Remark that quarantine files can contain more than one quarantined file, they will be numbered File_0, File_1, ...
If we look at the Details stream, it doesn" />
That" />
Thats readable, so let" />
Generic BackDoor.agb doesn" />
This is a JPEG file with an eval statement in the EXIF data.
Didier Stevens
Microsoft MVP Consumer Security
blog.DidierStevens.com DidierStevensLabs.com