Re: Executing files with ".jpg" extensions

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 02/27/05 

Date: Sun, 27 Feb 2005 15:37:33 -0500

Received a report from McAfee/AVERT identifying this as "Proxy-AIG" --

"A.V.E.R.T. Sample Analysis
Issue Number: 1671673
Virus Research Analyst - Hong Kong: V. Nguyen
Identified: Proxy-AIG

AVERT(tm) Labs, Hong Kong

Thank you for submitting your suspicious file.

Synopsis -

Attached is a file for extra detection, which will be included in a
future DAT set."

< email snipped >

The EXTRA.DAT for McAfee AV software is attached. 

--
Dave
begin 666 EXTRA.DAT
M(#$P-" Q-S@@,3,V(#$X," @-S<@,3<Y(#(Q-B Q,S @,30Q(" T.2 R,#4@
M,3<Y(#(T," @-3,@(" U(#$V, T*(" Q,R @-3$@,3DS(#$W.2 R-#$@(#4U
M(#$P." Q.#@@(#$S(" U,2 Q-SD@(#<V(" Q,2 R-#$@,3,W(#$X. T*(" Q
M,R @-3$@,30Q(" W.2 @(#D@(#4U(#$U-R Q-SD@(#$S(" Q,R Q,30@,3@Q
M(#(P-R @-34@,3$T(#$W. T*(" Q,R @-3$@,3$S(#$X,R @-3D@(#,U(#$T
M,2 Q-SD@(#4Q(#(P-" Q,SD@,3$S(" @.2 R,#0@,3,X(#$W.0T*(" Q,R R
M,#<@,3,W(#(S,2 @,CD@(#4Q(#$T,2 Q-#$@,C0R(" U,R @-SD@,3@S(#(T
M,B R,#0@,3$T(#$W. T*(#(T,2 @-34@,3,S(#$V,B @,3,@(#4Q(#$W.2 @
M-S8@(#$Q(#(T,2 Q,S<@(#<V(#(T,B R,#0@,3$T(#$Y, T*(#$T,R @-30@
M,30Q(" W-B R-#(@(#4P(#$T,2 Q-C<@(#$P#0HX-#DV(#(U-B @(#$R.3 U
M(" S-# @(%4Q#0H-"B R-34@,3<X(#$S-B Q.# @(#<W(#$W.2 Q.3(@,3,P
M(#$T,2 @-#D@,C U(#$W.2 Q-3@@(#4R(#$T,2 R-#,-"B Q-#$@,3$U(#$T
M,2 R-30@(#@W(#(S,B Q-# @,3DQ(#(Q-" @-3 @,3(X(#$P-" @,3(@(#0W
M(" X-B Q-S@-"B @-#4@,C,R(#$T," Q-#D@,C$T(" U," Q-C$@,30S(#$V
M." @-3@@,3,P(#$X." @(#(@(#8P(#$S," Q.#@-"B Q.3 @,3DU(#$V,2 @
M,C(@(" U(" V," Q,S @,3@X(" @,B @-C @,3,P(" W," Q.3(@,34P(#$S
M-R Q.#@-"B @(#(@(#8P(" V-B @,C(@(" X(" V," Q,S @(#8T(" S-2 Q
M-C,@(#0P(#$X,B R-#D@,3DR(#$R-R R,S,-"B Q.#D@,34P(#$T,R @-C8@
M,C T(#$U," Q,S8@(#8W(" S-2 Q,C(@,38Y(#(Q," Q-C@@(#4T(#$R-2 Q
M-3<-"B @-C@@(#(S(#$Y-B @,C(@(" Y(#$Y-2 Q-C,@,C4P(" T,R Q-3 @
M,3,W(" V-R @,S,@,3$U(#$R,R @,C(-"B @(#D@,3DU(#$V,2 R-#,@(#0S
M(#$U," Q-#,@,3$X(#(S,B Q-3 @,30S(#$Q-" @(#D@,34P(#$T," Q,C8-
M"B Q-C@@(#4P(" V-B @,C(@(#$U(" R,R Q.38@(#(R(" @.2 @,CD@,3DV
M(#$R-" @.#<@,34P(#$T,R Q-S4-"B @,C$@,34P(#$S,R R-30@(" R(" V
M," @-# @(#(R(#$U-2 @.#8@,3 T(" R,B @,3 @,3(V(#$S," Q.#@-"B @
M(#(@(#8P(" V-B @,C(@,38X(" T.2 Q.3,@,C(U(#$V." @-3(@,3,W(#$X
M." @(#(@(#8P(#$S," R,34-"B @-S(@,34P(#$T,R R,S,@,3@Y(" W,2 Q
M,30@,3@S(#$U-B @-#D@,30P(#$W." R,S4@(#0Y(#$Q-R @-S8-"B Q.38@
M(#4T(" V-" @,C @,38X(#$U," Q-C@@,3DY(#$S-R @-#D@,3,V(#$W.2 Q
M-C@@(#4P(" V-" @-C8-"B @,34@(#0S(#$T,2 @-#@@(#$U(" U,R Q-#$@
M(#@U(" Q-2 R,#0@,38R(#$R,B @(#@@,C4T(" T,B @,C(-"B Q-C@@(#(R
M(#(T.2 @-34@(#$U(" U-" Q-#$@(#(R(" Q,B R-30@,C0Y(#$P-" @,3(@
M(#(W(" Q-" Q-S<-"B @,3(@(#4Q(#(T," Q,#0@(#$R(" V,R Q,C@@(#0Y
M(" @." @-3$@,3$T(" W-B @,3(@(#4Q(#$U,R Q.# -"@T*,C(X,S @,C4V
M(" @,3(Y,#4@(#,T," @33$-"@T*(" X-" Q-S@@,3(Y(#$W." @-S<@(#4Q
M(#(R,2 Q.3,@(#DX(" W-2 R-#0@,34X(" W-B Q,C(@,C R(" S,@T*(" Q
M," @-3(@,C U(#$W.2 @,3,@(#4Q(#(R.2 Q.34@,C$U(" U," Q,CD@(#<V
M(" @.2 Q-S<@,30S(#$W. T*(" Q,R R-#(@,3(X(#(U,B @,3,@,C$U(" Y
M-R @.#$@,3,T(#(Q,2 Q,3(@(#@S(#$V." Q.#(@(" W(" X-PT*(#$R,2 R
M,#0@,30P(#$Y.2 Q,S<@(#0Y(#$T-B Q-SD@,38X(" V,R @,S @(#,T(#$S
M-" Q-C0@(#(X(" S,@T*(#$S-" Q-C,@(#(V(" U-B Q-30@,38W(#$R." @
M-#D@(" X(" U,2 @,38@,C4Q(#(T,B @-3 @,34S(#$R-@T*(" Q-2 @-3(@
M,30Q(#(U,R @,3 -"C@P-S<@,C4V(" @,3(Y,#4@(#,T," @4')O>'DM04E'
&#0H-"@T*
`
end