Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > alt.comp.hardware.pc-homebuilt > #40075
| From | "Apd" <not@all.invalid> |
|---|---|
| Newsgroups | alt.comp.hardware.pc-homebuilt, alt.comp.anti-virus, alt.computer.security |
| Subject | Re: Kaspersky Rescue Disk Report - can't see full paths |
| Date | 2019-06-06 01:19 +0100 |
| Organization | Aioe.org NNTP Server |
| Message-ID | <qd9mah$iig$1@gioia.aioe.org> (permalink) |
| References | <nejffe97aurtm817oikhrshavi00cfgkuo@4ax.com> <qd9c1h$lh$1@dont-email.me> |
Cross-posted to 3 groups.
"Paul" wrote: > When you look at the klr.enc1 files, what's the first > thing you notice ? There's a couple of groups of 0xCF hex > bytes. "Real" encryption would have high entropy. > This smells funny... > > CF CF CF CF CF CF CF CF CF CF CF CF It smells like spaces! XOR the base64 with 0xEF and you have plain text with a single linefeed terminating each line. It's an XML report. Here's a line from your second example, krdeicar.txt (wrapped for ease of reading): <Event1 Action="Detect" Time="132042218823887019" Object="@Filesystem[65ba0377-31a7-52e4-8e5b-5415b3a73f12]/Downloads/EICARAntiVirusTestFile.com" Info="EICAR-Test-File" />
Back to alt.comp.hardware.pc-homebuilt | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Kaspersky Rescue Disk Report - can't see full paths Shadow <Sh@dow.br> - 2019-06-05 12:21 -0300
Re: Kaspersky Rescue Disk Report - can't see full paths Paul <nospam@needed.invalid> - 2019-06-05 17:26 -0400
Re: Kaspersky Rescue Disk Report - can't see full paths Shadow <Sh@dow.br> - 2019-06-05 20:28 -0300
Re: Kaspersky Rescue Disk Report - can't see full paths "Apd" <not@all.invalid> - 2019-06-06 01:19 +0100
Re: Kaspersky Rescue Disk Report - can't see full paths Shadow <Sh@dow.br> - 2019-06-06 00:06 -0300
Re: Kaspersky Rescue Disk Report - can't see full paths "Apd" <not@all.invalid> - 2019-06-06 10:46 +0100
Re: Kaspersky Rescue Disk Report - can't see full paths "wasbit" <wasbitREMOVE@hotmail.com> - 2019-06-07 09:53 +0100
Re: Kaspersky Rescue Disk Report - can't see full paths "Apd" <not@all.invalid> - 2019-06-07 10:43 +0100
Re: Kaspersky Rescue Disk Report - can't see full paths Shadow <Sh@dow.br> - 2019-06-08 16:13 -0300
Re: Kaspersky Rescue Disk Report - can't see full paths "David B." <BDonTJ@REMOVE.gmail.com> - 2019-06-07 08:11 +0100
Re: Kaspersky Rescue Disk Report - can't see full paths Paul <nospam@needed.invalid> - 2019-06-06 02:15 -0400
Re: Kaspersky Rescue Disk Report - can't see full paths "Apd" <not@all.invalid> - 2019-06-06 10:48 +0100
csiph-web