TIP: Click on subject to list as thread! ANSI
echo: alt-comp-anti-virus
to: ALL
from: APD
date: 2019-06-05 20:19:00
subject: Re: Kaspersky Rescue Disk

"Paul" wrote:
> When you look at the klr.enc1 files, what's the first
> thing you notice ? There's a couple of groups of 0xCF hex
> bytes. "Real" encryption would have high entropy.
> This smells funny...
>
>     CF CF CF CF CF CF CF CF CF CF CF CF

It smells like spaces!

XOR the base64 with 0xEF and you have plain text with a single
linefeed terminating each line. It's an XML report. Here's a line from
your second example, krdeicar.txt (wrapped for ease of reading):




--- NewsGate v1.0 gamma 2
* Origin: News Gate @ Net396 -Huntsville, AL - USA (1:396/4)

SOURCE: echomail via QWK@docsplace.org

Email questions or comments to sysop@ipingthereforeiam.com
All parts of this website painstakingly hand-crafted in the U.S.A.!
IPTIA BBS/MUD/Terminal/Game Server List, © 2025 IPTIA Consulting™.