portable execution file format

Question

Microsoft Windows follows an executable file format called the PE (Portable Executable) files. A typical virus / mal-code tries to alter the file and inject malicious code in the file so that it would run during the life time of the program. By studying the file format indicate how this may be averted or what mechanisms are in place already to avoid it. Furthermore what modifications / mechanism do you suggest which may make changes to on-disk executable difficult if not impossible.

Answer 1

Hi,

Yes, Microsoft® Windows® uses the Portable Execution (PE) format, while back in the old Disk Operating System (DOS), Microsoft® used a format called: “MZ” format. Yes, I agree, viruses inject code, that can be executed every time the *.exe program file is executed.

Check out this link for PE details and virus injections: http://www.ntcore.com/files/inject2exe.htm
And: Check out my post:  http://social.msdn.microsoft.com/Forums/en-US/vbgeneral/thread/74a7566c-391a-4db1-b8eb-30c723db0358/

I hope this helps…

Have a nice day…

Best regards,
Fisnik

---

Coder24.com