|
PureBytes Links
Trading Reference Links
|
For Win 95 or 98 it's 280kb, at least. For Winnt or Win2000 I believe it's
over 400kb. I'm not sure about the dates, seems like I remember thinking at
one point that at least some files the virus changed did not have the
current date, but I really don't remember.
David
>Return-Path: <moongateca@xxxxxxxx>
>From: "Mike Higgs" <moongateca@xxxxxxxx>
>To: <mking@xxxxxxxx>,
> <omega-list@xxxxxxxxxx>
>References: <200109221907.MAA10796@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
>Subject: Re: TS4 error window (Nimda virus)
>Date: Sat, 22 Sep 2001 17:12:38 -0400
>X-MSMail-Priority: Normal
>Disposition-Notification-To: "Mike Higgs" <moongateca@xxxxxxxx>
>X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
>
>> For nimda, any program, like WordPad or MS Office, that uses riched20.dll
>> would have problems because the virus replaces it. If the riched20 file is
>> 57kb or so, it's the virus. I don't know if TS4 would use that file, or
>if
>> Win2000 even has that file (I would guess it does).
>
>What size should this file be? If it has been infected, would it show a
>change in date?
>
>Regards,
>Mike
>
>
>
>
|