Author Topic: Suspicious whitespace sequence  (Read 4071 times)

Offline kalipto

  • Newbie
  • *
  • Posts: 2
  • I'm a llama!
    • Personal Message (Offline)
Suspicious whitespace sequence
« on: January 12, 2004, 11:01:43 AM »
Hi,

Sometimes, I received JPG pictures by mail whose titles contain 6 white spaces instead of one. For instance: "town near      the river". Avast doesn't really appreciate it and displays a "Suspicious message" window mentioning a "suspicious whitespace sequence"  ???
Since I don't think the picture sender intentionnaly inserted white spaces in his picture title (it happens regularly with always 6 white spaces instead of 1), does someone know if a virus could do that ? I tried to make research on google for that but I didn't find anything. These pictures were stored on an iPaq before being sent to me. This behavior is recent. No problem before.
Thanks for your help.

Offline Culpeper

  • avast! Evangelist
  • Super Poster
  • ***
  • Posts: 1208
    • Personal Message (Offline)
Re:Suspicious whitespace sequence
« Reply #1 on: January 22, 2004, 02:37:43 AM »
Have you completed a virus scan yet?  If nothing shows up than you probably have nothing to worry about, naturally.
The wind in the wires made a tattletale sound
And a wave broke over the railing
And every man knew, as the Captain did, too,
T'was the witch of November come stealing.

Offline Vlk

  • Global Moderator
  • Serious Graphoman
  • **
  • Posts: 11565
  • Gender: Male
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
    • Personal Message (Offline)
Re:Suspicious whitespace sequence
« Reply #2 on: January 22, 2004, 10:02:10 AM »
The message is (a bit) suspicious because some viruses use the following trick: they've an attachment called e.g.

Info.txt                                                                               .exe

Because the window in which the names are displayed has a size limitation, it's quite likely that the .exe extension will not be displayed (will be clipped), making the user think that it's a TXT file, instead of an EXEcutable.

If you want, you can turn off the whitespace checking but in 99.9% of cases you shouldn't really see any (legal) attachments with names like that...
If at first you don't succeed, then skydiving's not for you.

Offline kalipto

  • Newbie
  • *
  • Posts: 2
  • I'm a llama!
    • Personal Message (Offline)
Re:Suspicious whitespace sequence
« Reply #3 on: January 23, 2004, 03:13:08 PM »
Thanks a lot for your answers. :)
Actually, I scanned  my disk and found no particular viruses.
I am really happy to understand why Avast was so suspicious. But the attached files with names with spaces were no exe (pcw or most often jpg). So I don't really know the reason of these additional spaces. Maybe a mailer bug. But the pocket PC (iPaq) where the original files were stored before being mailed to me, had been infected previously by a virus called "HTML.redolf.A". I mean the storage card contained files infected by this virus. The infected files were supposed to be eradicated. But I don't really think there is a link...

 

Google Chrome

AVAST recommends using the FREE Google Chrome™ browser.

Download Google Chrome Now