On Wed, Jun 03, 1998 at 05:33:33PM -0400, Ferd Lazarus wrote:
> I presume that uuencoding a Word file, that contains a
> virus, does nothing to disable the virus once the
> file is uudecoded back to the original format.
That's correct. Putting a file through a uuencode->uudecode sequence
equates to a no-op.
> The question: Is there anything you can do to disable the
> uuencoded virus and still recover the message?
Yes, if you have a Unix/Linux box. I've succesfully extracted the contents
of Word/WordPerfect/etc. documents by using the "strings" command,
which is shipped with most Unix/Linux implementations.
Excerpt from the strings manual page follows...
NAME
strings - find printable strings in an object file or binary
SYNOPSIS
strings [ - ] [ -o ] [ -number ] filename ...
DESCRIPTION
strings looks for ASCII strings in a binary file. A string
is any sequence of 4 or more printing characters ending with
a NEWLINE or a null character.
strings is useful for identifying random object files and
many other things.
OPTIONS
- Look everywhere in the file for strings. If this flag
is omitted, strings only looks in the initialized data
space of object files.
-o Precede each string by its offset in the file.
-number
Use number as the minimum string length rather than 4.
[ end extract ]
I've had to fiddle with the minimum string length to make this work;
most of the time, the default length of 4 works, but I've had to
crank it down to 2 on occasion.
Note that what you get out of this is not a sanitized ASCII rendition
of the text of the message -- it's got embedded junk in it. But it *is*
readable and can now be further processed with standard tools -- including
any old text editor, if it's a short message.
---Rsk
Rich Kulawiec
[EMAIL PROTECTED]
____________________________________________________________________
--------------------------------------------------------------------
Join The Web Consultants Association : Register on our web site Now
Web Consultants Web Site : http://just4u.com/webconsultants
If you lose the instructions All subscription/unsubscribing can be done
directly from our website for all our lists.
---------------------------------------------------------------------
