right here <right@here.com> wrote:
> They are using unicode control codes. By doing that they can have
> part of the filname being displayed backwards. Note that many
> viruses/trojans ends in RCS.jpg
>
> The ending is actually gpj.SCR but by inserting a RLO code (right to
> left override) it is displayed backwards.
>
> "cool picture [ROL]gpj.SCR" will be displayed as "cool picture
> RCS.jpg"
>
> It's quick to identify. They always have RCS, EXE or other
> executable file names in reverse before the "fake" extension.
>
> Also the file type column in windows displays the real file type.
I love you for teaching me this. Could you please expand on that last
sentence a little - I'm not sure I understand.
P.S. Thanks also for the web link explaining about the unicodes. (I think
you posted it, if not, thanks to whoever did.)
|
|