GIFS

#1 EdBee

Forum Regular

Group: Members
Posts: 208
Joined: 13-July 04

Posted 27 July 2004 - 12:45 PM

I have read thru your tutorial on comp imaging-very good. But, of course, I have questions.

1. What is it about GIFS as ooposed to other files and formats that makes them so Ideal for hiding trojans within etc?? Just wondering. I remember some advise that one cleaning technique is to get rid of temp and GIF files.

2. I have in the past tried to do/work with animated GIFS, but never successful (I didn't try very hard) How does one build/construct a file with individual GIFS and then cause them to animate?

3. And, when I clicked on the link (on the tutorial) to look at an example of GIF animation it was Xd out-would not open!! Is this a setting in MSIE?

Not a critical matter, but if anyone has info/links I would appreciate

EDBEE from NMUSA- RENOWNED MALWARE FIGHTER AND SWORN ENEMY OF ALL INTERNET HIJACKERS

#2 raw

Bleeping Hacker

Group: BC Advisor
Posts: 2,294
Joined: 14-April 04
Gender:Male
Location:Texas

Posted 27 July 2004 - 01:14 PM

The Graphics Virus Myth
There are two reasons that the graphics virus myth won't die.

* One is that it happens all too often that someone clicks on a graphic and then has their PC crash (sometimes with damage to the programs and data on the disk. This is due to bugs (or conflicts) in the browser software not because of an attack from a virus or a trojan.

* The other reason is that there have been a number of virus infected Usenet postings (often in the sex related areas) where the graphic files include a viewer program. Such a program (unlike the graphics themselves) can easily be infected.

http://cuip.net/~billings/AnimationWorkshop/
http://www.htmlgoodies.com/tutors/animate.html
http://www.peachpit.com/articles/article.asp?p=31536

IE - Tools/Internet Options, click on Advanced tab, scroll down to multimedia
Check Play Animations, Show Images.

HOSTFix only works on XP,no longer maintained

#3 TedOb1

Member

Group: Members
Posts: 31
Joined: 19-August 04

Posted 19 August 2004 - 04:12 PM

if youd like to see for yourself why gifs are a popular way to hide and run trojans open a dos prompt and enter:

copy c:\windows\system32\ping.exe c:\windows\system32\ping.gif

now from the same prompt just enter: ping.gif

the ping program will execute. this works only from a comand shell. if you were to double-click ping.gif in windows explorer it would try to open it with whatever graphics program your machine has registered for .gif files and you'll get an error.

you can build an animated gif using paintshop pro's animation shop. there's also a freeware program called gifbuilder if i remember correctly