SLINE@ITHACA.BITNET (Sliner) (02/28/91)
I know viruses sometimes increase file lengths, but can a
virus decrease a file length? The reason why I was asking was on a
bank of PCs in a lab, the ipx.com file was 26666, but on one machine
in the bank, the size was 25500, and the file had the correct date.
Another problem was that the machine was notreading the autoexec.bat
file when the computer was booted up. I ran scan 72, but it did not
detect anything.
Thanks in advance,
Dan Sline
Bitnet: Sline@Ithaca
Internet:Sline@Ithaca.bitnet
P.S. Could someone please post to list or e-mail me a message when the next
batch of scan programs from McAfee is available (I currently have V74B)?zmudzinskit@imo-uvax5.dca.mil (zmudzinski, thomas) (03/01/91)
In VIRUS-L Vol 4 #33, Dan Sline said: > I know viruses sometimes increase file lengths, but can a > virus decrease a file length? The reason why I was asking was on a > bank of PCs in a lab, the ipx.com file was 26666, but on one machine > in the bank, the size was 25500, and the file had the correct date. > Another problem was that the machine was notreading the autoexec.bat > file when the computer was booted up. I ran scan 72, but it did not > detect anything. I can only offer theoretical knowledge on this as I know of no virus that actually does what I'm about to describe, but yes, it is possible for a virus to compress an executable and preface it with itself (including the necessary expansion code) such that the file length decreases. However, it would be sloppy of the illegitimate vermin who coded such not to pad the file out to its original size. I suggest you compare the two files. One dead giveaway: compress- ed files don't look anything like uncompressed ones. Tom Zmudzinski | Internet: ZmudzinskiT@IMO-UVAX.DCA.MIL "Better to trade knowledge than something of value" -- Sergio Aragones