Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am encountering a strange issue with en executable file. When I transfer this executable from PC A to PC B using IP messenger its size changes. Functionally, it still behaves in the same manner. Again, when I further transfer the file from PC B to PC C, the executable reverts back to the original size. I tried comparing both these executable files of different sizes using HEX compare and there are quite a lot of bytes that have changed.

What could be the reason for this?

NOTE: All these systems using Windows operating system.

share|improve this question
4  
Have you updated your virus definitions lately? Also, could you confirm that the hash (like CRC32) changes as well? –  Gleno Sep 30 '11 at 3:19
3  
Differing block sizes could cause a minor change in actual file size, but the contents of the file shouldn't change. –  user55325 Sep 30 '11 at 4:20
    
@Gleno: Just FYI, but CRC32 is not a real "hash" and is easy to collide. For file integrity, MD5 or SHA are better. –  grawity Sep 30 '11 at 8:59
    
@grawity, the probability that two different files output same CRC32 is low enough. You are right in that there exist better hashes, but CRC32 is a very common check for file integrity. –  Gleno Sep 30 '11 at 9:47
    
@Gleno: Yes, but only against accidental corruption, not malware. (Unrelated, but interesting: many Microsoft-distributed ISOs have FFFFFFFF as their CRC32.) –  grawity Sep 30 '11 at 10:00
add comment

migrated from stackoverflow.com Sep 30 '11 at 3:20

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 3 down vote accepted

If transferring an executable from system A to system B changes it in some way, and transferring it back to system A apparently changes it back, then I'd say it a common sign of a virus infection. That is, the EXE file is infected. However, on the original system (A) this virus is active, and makes the file size to be reported as it was originally. However, checking the copied file on a "clean" system (B) you can see the difference.

My advice is, upload the EXE file from system B (where the file appears to be bigger) to VirusTotal, which will have it checked with many antiviruses simultaneously, in a matter of minutes. If the file is infected, you'll most probably know it.

share|improve this answer
    
Can you elaborate as to why a virus would make a file appear larger on a system? Theoretically, I guess I could see how it could affect what a utility might display as a size. Am I missing another possibility? –  Beaming Mel-Bin Oct 2 '11 at 4:18
    
When a virus infects a file, it adds its payload to it, so the file grows. To avoid detection, on an infected system (where the virus is resident and active), it shows the filesize as it was before infection. But if you copy that file to a clean system, you see its true size, which is what it was before it got infected plus the size of the virus payload. –  haimg Oct 2 '11 at 4:32
    
Curiosity: Are you aware of how a virus is able to control what size is reported for a file? –  Beaming Mel-Bin Oct 2 '11 at 4:35
2  
Yes. I worked in an antivirus company many years ago. Basically you write a filesystem filter driver... Then you can do all kinds of "funny" stuff, e.g. return different file size depending on who's asking, etc. –  haimg Oct 2 '11 at 4:42
1  
Thanks for the insight! +1, interesting stuff. Sorry for the tangent :-) –  Beaming Mel-Bin Oct 2 '11 at 13:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.