🚀 go-pugleaf

Hi...

     Vesselin Bontchev (T762102@DM0LRZ01.BITNET) writes:

>> For .COM files:
>>        If the contents of the word at offset 02 in the file is 12Eh,
>> then the file is infected.

   No. The file isn't infected if the contents of the word at offset 02
   in the file is 12Eh. (i.e. If I have an infected program, this always
   have the word 12Eh at offset 02, because this word is part of an
   instruction of the virus).

>> For .EXE files:
>>         If the contents of the word at offset 02 in the file is equal
>> to the negated contents of the word at offset 12h, then the file is
>> infected.

   No. If the contents of the word at offset 02 (Number of bytes
   contained in last page) is equal to the negated contents of the
   word at offset 12h (negative sum of all the words in the file),
   then the program ISN'T INFECTED.
   (In the process of infection, the virus negates the number of bytes
    contained in the last page of the EXE program, and this value it
    puts at offset 12h of the header (i.e. as the negative sum of all
    the words in the file).

>> Unfortunately, this does not give us a method for file vaccination,
>> since the contents of the bytes mentioned above is used. For .COM
>> files, the byte at offset 02 is usually (not always!) the third
>> byte of a JMP instruction. For .EXE files the situation is
>> easier --- the word at offset 12h contains the so-called checksum,
>> which is never used and can be modified.

   I completely agree with you.

Disclaimer: The views expressed are my own! I do not speak for, nor do
            I represent any other person or company.

Gonzalo M. Rojas Costa
BITNET: LISTVIR@USACHVM1
ARPA: LISTVIR%USACHVM1.BITNET@CUNYVM.CUNY.EDU
Owner of ASSMPC-L ("Assembly for the IBM-PC")
Antiviral Research Group
Technical Support Unit
Universidad de Santiago de Chile