multiple partitions are safer in virus infection?

[Sugien]

Yes, to you and I, as programmers and network designers there is, but,
to IE, not long ago, there was no difference. You could rename the
script file to .JPG or .GIF and open it in IE and it would execute the
script. If you had a virus that deleted the contents of a valid jpg/gif
and copied itself into the file, it would run also.

I've tested this in the past and was amazed the IE would do this, since
service packs (I think around SP2) it has not done this, but I recall
thinking it would never execute and sure as heck it did.


But to the Windows OS, a file extension is often the determining factor
in what opens/executes the file - and that means that if IE was set to
open JPG files, then looked inside the JPG file (which it use to do) and
determined it was executable code, it would execute it. So, it didn't
really matter what the file type (based on extension) was/is, it was a
threat.

Have fund getting anyone here to agree; because they will most likely
say that unless the jpg can sit in a folder or on the desktop and self
replicate without user intervention that it isn't a valid virus. Don't even
get them started on whether or not an email can be a virus; because they
will say that although some (OE/O in particular) email readers read html and
some time back even parsed javascript and executed that the email it's self
could not be a virus; because it was only a vector or entry point into the
pc and not a virus in and of it's self just because it contained virus
instructions.
The purists will most likely say that unless a virus can inject it's
code into another program and then that program likewise seeks out and
injects the viral code contained within it's own code into another program
well it just is not a virus to them. Much like the old BIOS debate about
whether or not trashing a BIOS by flashing it with garbage where or not the
BIOS it's self has been harmed; because they will say much like a hard drive
that the BIOS that is flashed with garbage can be re-flashed even if it is
soldered in and that it would be cheaper to just buy a new mother board, the
purists say that the molecular structure of the BIOS chip was not harmed and
that if you were to look at it under an electron microscope that it would
still be ok and that re-flashing it would correct the problem. yadda ,
yadda, yadda, ect. ect. ect. Oh and lets not even mention being able to put
viral code into the un-used portions of the CMOS data chip which contains
the data to be used by the BIOS program; because seeing as how it would be
unlikely *anyone* would write a virus that would only work on a small
percentage of machines, and unless it has been created then it isn't so.
I guess it is much like when they were told back before Melissa that
just reading an email could infect a machine, they said that no it could or
would not be a virus in the email it's self because the email it's self
would only be an entry vector because the email required that the email
program parse and then execute the code for the email to infect and because
the email could not infect by it's self,
oh good grief Charley Brown (normal average user) don't try and kick
that ball again (try and explain to them that to the average user if
something infects their pc, to them it is a virus no matter if it does
require something other then the vector infector by its self to *email* to
infect) Lucy (so called AV experts) is going to pull the ball back (disagree
and not allow the average user to use terms they understand) and cause
Charley Brown (average user) to fall flat on his back again (get infected;
because the AV experts don't want to make things understandable; because it
just would not be cricket to use terms that the average user has come to
mean one thing when the AV experts know that if they are nit picky those
same terms *really* mean something else.

ah, come on now if an email is read by a user and they were not infected
before they read it and then after they read it, they *are* infected then to
them the email *IS* a virus. Never mind that the email it's self is not
self replicating and instead is only a vector into the system and that the
email program parses the code contained in the html or to be more precise in
the script code contained within the html and then executes it. Well this
is just an example; because Melissa is long gone; but other vector infectors
will most certainly find new holes to exploit. Also just a certainly, the
AV *experts* will find quite a few *holes* in my arguments; but what they
hey, they might just spark some *needed* exchange of information with which
maybe a few average users may learn something<S>

 

[Art]

Yes, to you and I, as programmers and network designers there is, but,
to IE, not long ago, there was no difference. You could rename the
script file to .JPG or .GIF and open it in IE and it would execute the
script. If you had a virus that deleted the contents of a valid jpg/gif
and copied itself into the file, it would run also.

I've tested this in the past and was amazed the IE would do this, since
service packs (I think around SP2) it has not done this, but I recall
thinking it would never execute and sure as heck it did.


But to the Windows OS, a file extension is often the determining factor
in what opens/executes the file - and that means that if IE was set to
open JPG files, then looked inside the JPG file (which it use to do) and
determined it was executable code, it would execute it. So, it didn't
really matter what the file type (based on extension) was/is, it was a
threat.

Two items from Art's Ye Olde Windows Hardening List:

33. Always associate JPGs, GIFs, etc., with your viewer of choice ...
such as IrfanView.
10. Never allow IE to be the default browser.

Art

http://home.epix.net/~artnpeg
Free antivirus:
http://www.ik-cs.com/programs/virtools/KASFX.EXE
http://www.claymania.com/KASFX.EXE
http://tinyurl.com/azzkc

 

[Norman L. DeForest]

Possibly. I don't recall. Where's Norman DeForest when you need him?
He brought it up.

You rang?

Some tests made by others (I don't have a Windows NT-based system) showed
that this is (or "was" if M$ fixed it) a major security hole in Windows'
CMD.EXE processing. An executable can be given *any* extension and if the
full filename and extension are given in the command-line, the program
will be run. Note that this won't work with Windows 98 or its relatives.
The following will run a copy of CALC.EXE (if it's available on Windows
NT -- the directory name may also differ -- but, as I said, I don't have
an NT-based system for reference):

C:\WINDOWS>COPY CALC.EXE FOO.TXT
1 File(s) copied

C:\WINDOWS>FOO.TXT

The following will *not* work:

C:\WINDOWS>COPY CALC.EXE FOO.TXT
1 File(s) copied

C:\WINDOWS>FOO

"Social engineering"[1] could trick someone into downloading SkinPic.jpg
and then typing "SkinPic.jpg" at the command-line.

[1] in other words, lying.