From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: A new way to damage EXE files (PC)
Date: 23 Sep 92 08:57:12 GMT

Hello, everybody!

As you probably know, several viruses of the Jerusalem type are unable
to infect the EXE files correctly. They destroy those EXE files that
have internal overlay structure (e.g., WordPerfect). The following
paragraph describes in short why this happens; those of you that
already know it, please skip to the next paragraph, where a new kind
of incorrect EXE files infection is described.

A virus which appends itself to the EXE files has three ways to
determine the file length (i.e., the end of the file). The first is to
look in the FAT and to count the clusters that the file occupies.
However, this is difficult and does not give the file length exactly -
it gives it in clusters, not in bytes. The second method is to use the
information in the directory. This is usually achieved by doing a
seek to the end of the file. The third method is to use the
information about the file size, present in the EXE header. This is
exactly what the Jerusalem-like viruses do. Unfortunately, the size
listed in the header is not necessarily the true file size. It is the
size of the portion of the file, that has to be loaded at runtime
(sometimes called the loadable part). If the size of the loadable part
is greater than the true file size, DOS refuses to run the file and
outputs an "Error in EXE file" error message. (The same happens if the
size in the FAT is greater than the size in the directory.) However,
the size of the loadable part can be shorter than the true file size.
Such files are those with internal overlay structure. The
Jerusalem-like viruses append themselves after the loadable part
(because they compute the file size from the information in the
header) and therefore overwrite the first internal overlay. The
program becomes damaged - it is not possible to recover it by removing
the virus.

During out meeting at the 2nd Virus Bulletin conference in Scotland,
Fridrik Skulason, Marek Sell (a Polish anti-virus researcher) and me
discovered a new way to infect EXE files incorrectly, that some
viruses are using.

Those viruses correctly append themselves after the physical end of
the file. However, when correction the information in the EXE header,
the viruses just ADD the virus size to the size listed there.
Therefore, at runtime, DOS will load more than the initial loadable
part. It will load part of the first overlay - that much of it as is
the length of the virus. But it will not load the virus! However, the
entry point in the EXE header still points to the virus. Therefore, it
points to a place, where nothing is loaded. Obviously, such files
cannot be executed and will probably hang the machine.

However, unlike the previous case, such files can be recovered by a
virus-removing program. The program just must know about this property
of the virus and SUBTRACT the virus size from the appropriate fields
in the EXE header - instead of putting there the full file size minus
the size of the virus.

Currently we have noticed at least two viruses, which act in the way
described above. Those two viruses are Amoeba and Boojum. Without any
doubt, several other of the known viruses act in this way. Producers
of virus-removing programs should take care to recover correctly the
files infected with such viruses.

As a conclusion, it is a bad idea to rely on virus disinfectors. Just
delete the infected programs and replace them with clean backup
copies.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany