Jump to content

Special characters in filename leads to starting virus executable


Recommended Posts

I've just downloaded torrent with one file in it - the formal name of file should be "123.avi.exe" (which is typical for viruses and trojans). Now, interesting thing is that name is encoded in UTF16-LE as following bytes:


which gives us strange, partially reversed over ".exe" text (try to move cursor left-to-right and you will be surprised):


But the bad part of all - is that utorrent showing non-suspicious ".avi" extension while when you double click it in GUI - it goes as as ".exe" and program runs.

You can test it yourself by creating dummy file with the name I wrote above. Screenshots attached.

Please fix this by preventing to run executables if it's name contains special characters (like Total Commander does).




Link to comment
Share on other sites


This topic is now archived and is closed to further replies.

  • Create New...