Kev Ford wrote: > Just an idle thought, but what about scripting? Would it be possible to > get some simple scripts through simply by making a large portion of the > end of the message useless comment fields? Maybe even a worm that > rewrites this 'noise' every time to make a moving target? Yep, but it need not even be that deliberate. Windows VBS with its ever so forgiving "resume next" "error handler", and some other "resilient" scripting languages (such as mIRC script), means that even some badly truncated malware can be executed "successfully", so long as the "important" part(s) of its functionality are nearer the beginning of the script code than the end. Scripts in such languages that get rogered through partial transmission (this was very common with early mIRC script viruses) can keep on going in their new, truncated forms until they finally get chopped before the minimal code point that makes them replicative. And yes, we have seen this happen in the wild many times already. -- Nick FitzGerald Computer Virus Consulting Ltd. Ph/FAX: +64 3 3529854
