TDB by Netko, is a small, powerful free computer database program for the Windows operating system. With a little bit programming you can make very useful databases with many intelligent reports. The databases and reports are displayed in a tabbed window. With one right-click in a database you can simply maintain the data (edit, add, search, replace and delete records). Clicking on the headerbuttons allows you sort to data in the required order. Through the menu commands or toolbar you can open, save, import, export or print records or reports. There is a facility provided to generate graph's and display data with attractive shapes. Some statistics functions are also included. There are intelligent commands for reports, multiple field search and replace, extensive ASCII import/export function, integrity self-check to ensure you got the original, uninfected copy of the program and help file. Research TDB
The DMV Word Macro Virus is a Microsoft Word macro virus which infects Microsoft Word documenrs. It contains only one macro - AutoClose, and infects the files that are saved on disk. While infecting, this virus displays the MessageBox'es with the header: Document Macro Virus The messages are: Counting global macros. AutoClose macro virus is already installed in NORMAL.DOT. AutoClose macro virus already present in this document. Saved current document as template. Infected current document with copy of AutoClose macro virus. Macro virus has been spread. Now execute some other code (good, bad, or indifferent). Research DMV Word Macro Virus
The EXE virus concept is as follows: first, the original Disk Transfer Address is preserved to avoid changing command-line text. Also initial values of the CS, IP, SS, SP DS and ES registers are saved (to be restored on exit from virus code). The virus is to be appended to the original code and, of course, has to be relocated before it's executed. Thus, the virus looks for an EXE file. Then it has to know if this is in fact an EXE (checking for the magic ' MZ' signature) and if there is any free space in the program's relocation table. This is checked by substracting the relocation table end (i.e. sum of table start and number of relocation items, multiplied by the table entry size) from the EXE header size. A smart virus shouldn't infect a file that's already infected. So the first four bytes of code to be executed are compared against the virus code. If they match one another, no infection takes place. Other signature methods are used, but this is the most common. Having found a suitable file, the virus computes
its code end and appends itself at the end of code, writing at an alignment to the last 512-bytes page boundary if necessary. The original start address is preserved inside the virus, and the CS:IP value in the EXE header is changed, so that the virus code is executed first. The number of pages is changed, together with the Last Page Size and Number Of Relocation Items. A new relocation item address is appended to the relocation table, pointing to the segment of the far jump in the virus (this is the jump the virus uses to return to the original code). Upon returning from the virus, all the saved registers and DTA are restored to reestablish the environment state as if no virus existed. The real trouble with EXEs is that DOS pays a little (if any) attention to the Last Page Size. Therefore EXE files ofen have this zeroed, even if they have some code on the last page. Writing to the last page can cause a system crash while an infected file is being executed. To solve the problem, one should first test if the EXE file really ends as the header
contents say and move to the last page end instead of appending any bytes, if possible. Another problem is infecting EXEs containg debug info. Debug info comes in various formats, and often contains vital information placed behind the actual code. This info gets destroyed when the file becomes infected, sometimes causing the infected program to crash. Research Exe Virus Concept
Microsoft's Internet Explorer version 6.0 and also Outlook and OutlookExpress programs and other programs using the Internet Explorer rendering engine are vulnerable to attack because of a failure within the Internet Explorer rendering engine to check the content of files against their MIMEheader. This means that an executable file disguised with a MIME heading representing an image file will be executed, the Internet Explorer rendering engine believing the file to be an image. The BadTrans worm is one example of a malicious program that utilises this vulnerability. Research Internet Explorer MIME Header Vulnerability
SOH is an abbreviation for Start Of Header
SOH is an abbreviation for Start of Heading
SOH is an abbreviation for Suborbital Operations Handbook Research SOH
In bricklaying, Flemish bond is a brick pattern in which each course of masonry consists of headers and stretchers that are laid alternatively with each header centred with respect to the stretcher above and below it. Research Flemish Bond
In architecture a header is a brick or stone laid with its shorter face or head in the surface of the wall.
In framing, a header is the piece of timber fitted between two trimmers, and supported by them, and carrying the ends of the tailpieces. Research Header
Abbreviations
Research TDB
