Yesterday I mentioned that McAfee quarantine files on Windows (.BUP extension) are actually OLE files.

Im going to write a couple of diary entries highlighting some file types that are OLE files, and I" />

As you can see, this quarantine file contains two steams: Details and File_0. Details is the McAfee anti-virus report, and File_0 is the quarantined file. Remark that quarantine files can contain more than one quarantined file, they will be numbered File_0, File_1, ...

If we look at the Details stream, it doesn" />

That" />

Thats readable, so let" />

Generic BackDoor.agb doesn" />

This is a JPEG file with an eval statement in the EXIF data.

Didier Stevens
Microsoft MVP Consumer Security
blog.DidierStevens.com DidierStevensLabs.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Internet Storm Center Infocon Status