17 Jul
2001
17 Jul
'01
6:35 p.m.
OT, yes (maybe some virii are >10 years old??) but related to programming in
general. Plus, if no one on this list knows the answer, then there probably
*isn't* an answer ;>)
I received a virus in an e-mail attachment a few minutes ago. The sender is
a wholesale supplier I'm acquainted with. NAV spotted the
"W32.Magistr.corrupt" virus, could not repair the infected item, and asked
for permission to delete the item, which I granted.
I looked this virus up in the list of 50K+ virii that NAV currently claims to
cover. No information was available, except that this virus is rare, it
infects .exe files, and it is zero bytes in length.
Now, I've cranked out a couple of boatloads of code over the last 19 years,
and the smallest useful program I ever wrote was 3 bytes in length. It's
easy enough to create a zero byte file, but as far as I can tell such a file
can't *do* anything.
How can I write a zero-byte program? How does NAV identify this virus if
it's zero bytes in length? What real threat to my PC is an e-mail-propagated
virus of length zero?
WTF???
TIA,
Glen
0/0
18 Jul
18 Jul
11:26 a.m.
A non-text attachment was scrubbed...
Name: not available
Type: text
Size: 1510 bytes
Desc: not available
Url :
http://www.classiccmp.org/pipermail/cctalk/attachments/20010718/5742df2d/at…
1:07 p.m.
Rumor has it that Tony Duell may have mentioned these words:
Either that, or it's a typo on NAV's website...
Roger "Merch" Merchberger
--
Roger "Merch" Merchberger --- sysadmin, Iceberg Computers
Recycling is good, right??? Ok, so I'll recycle an old .sig.
If at first you don't succeed, nuclear warhead
disarmament should *not* be your first career choice.
Rumor has it that Glenatacme(a)aol.com may have mentioned
these words:
> I looked this virus up in the list of 50K+ virii
that NAV currently
claims to
> cover. No information was available, except that
this virus is rare, it
> infects .exe files, and it is zero bytes in length.
>
> Now, I've cranked out a couple of boatloads of code over the last 19
years,
> and the smallest useful program I ever wrote was 3
bytes in length. It's
> easy enough to create a zero byte file, but as far as I can tell such a
file
> can't *do* anything.
>
> How can I write a zero-byte program? How does NAV identify this virus if
> it's zero bytes in length? What real threat to my PC is an
e-mail-propagated
virus of
length zero?
My guess (never having seen this virus, and certainly never having
written a virus) is that the code is not 0 bytes long (for the obvious
reason), but that it overwrites some bytes in the files it infects rather
than addting itself to the file, so the file remains the same size.
So the _change_ in file size is 0 bytes. 
2:52 p.m.
It was thus said that the Great Tony Duell once stated:
My guess (never having seen this virus, and certainly never having
written a virus) is that the code is not 0 bytes long (for the obvious
reason), but that it overwrites some bytes in the files it infects rather
than addting itself to the file, so the file remains the same size.
So the _change_ in file size is 0 bytes.
Of course this there is real virus code in the infected file, NAV can
detect that particular byte pattern.
And maybe because it overwrites part of the file, information from the
file is lost, which is why the file can't be disinfected
I used to do a lot of assembly programming under MS-DOS and I found that
if I did
;********************************************
segment para public 'DATA'
some_value dw 34
some_string db 'Hello there',0
some_buffer db 4096 dup(0)
end segment
;********************************************
That when that particular segment was assembled, the amount of space it
took up in the executable was 5,010 bytes---the large areas of 0 filled
space wouldn't be compressed at all! And in looking over other executables
(ones from Microsoft, others from elsewhere) revealed huge portions of
executable files nothing but zeros. There was no compression done of at
least the data segment. So it would be easy enough for a virus to scan the
executable for a portion that is nothing but zeros, and hide in there.
-spc (Figure this might be on topic since it's been 10 years or so since
I've done MS-DOS assembly programming 8-)
4:37 p.m.
On Wed, 18 Jul 2001, Sean 'Captain Napalm' Conner wrote:
some_buffer db 4096 dup(0)
end segment
That EXPLICITLY calls for 4K of 0's.
Virtually no assembler is clever enough to do a run-length compression.
OTOH, If you wrote
some_buffer db 4096 dup (?)
it would set up 4K of "UNINITIALIZED" space, which it COULD compress out
of the file, particularly if it is at the end.
. . . So it would be easy enough for a virus to scan
the
executable for a portion that is nothing but zeros, and hide in there.
It could
always make space within the MICROS~1 copyright message.
--
Grumpy Ol' Fred cisin(a)xenosoft.com
4:36 p.m.
The zero byte length probably means the length of the infected file
changes by zero bytes... IE it overwrites some bits of the program.
Clint
On Tue, 17 Jul 2001 Glenatacme(a)aol.com wrote:
OT, yes (maybe some virii are >10 years old??) but
related to programming in
general. Plus, if no one on this list knows the answer, then there probably
*isn't* an answer ;>)
I received a virus in an e-mail attachment a few minutes ago. The sender is
a wholesale supplier I'm acquainted with. NAV spotted the
"W32.Magistr.corrupt" virus, could not repair the infected item, and asked
for permission to delete the item, which I granted.
I looked this virus up in the list of 50K+ virii that NAV currently claims to
cover. No information was available, except that this virus is rare, it
infects .exe files, and it is zero bytes in length.
Now, I've cranked out a couple of boatloads of code over the last 19 years,
and the smallest useful program I ever wrote was 3 bytes in length. It's
easy enough to create a zero byte file, but as far as I can tell such a file
can't *do* anything.
How can I write a zero-byte program? How does NAV identify this virus if
it's zero bytes in length? What real threat to my PC is an e-mail-propagated
virus of length zero?
WTF???
TIA,
Glen
0/0
8407
days inactive
8408
days old
5 comments
6 participants
participants (6)
-
ard＠p850ug1.demon.co.uk -
cisin＠xenosoft.com -
Glenatacme＠aol.com -
spc＠conman.org -
vaxman＠qwest.net -
zmerch＠30below.com