Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: dealing with w32/bagle

  • From: Jeffrey I. Schiller
  • Date: Wed Mar 03 16:20:28 2004
  • Spam-alum-prob: 0.000000
  • Spam-alum-time: 1.195335

Turns out that the ZIP file format that all of these beasties are
using is a little bit non-standard. Specifically they are all version
1.0 zip archives and the first (and only) component is not
compressed.

At MIT we are matching these two strings to recognize the infected ZIP
files while letting most (actually I have seen no false positives) if
not all "real" ZIP files. We are matching them anywhere within an
attachment (well, within the first 16K). However you really only need
to see if they are the beginning characters (this is a ZIP file
header).

What follows are the base64 encoded strings. I have put an asterisk
between the first and second character, so my own filters won't reject
this message, do remove that before using...

U*EsDBAoAAAAAA   <= Matches unencrypted ZIP file
U*EsDBAoAAQAAA   <= Matches encrypted version.

			    -Jeff





Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.