Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am encountering a strange issue with en executable file. When I transfer this executable from PC A to PC B using IP messenger its size changes. Functionally, it still behaves in the same manner. Again, when I further transfer the file from PC B to PC C, the executable reverts back to the original size. I tried comparing both these executable files of different sizes using HEX compare and there are quite a lot of bytes that have changed.

What could be the reason for this?

NOTE: All these systems using Windows operating system.

share|improve this question

migrated from Sep 30 '11 at 3:20

This question came from our site for professional and enthusiast programmers.

Have you updated your virus definitions lately? Also, could you confirm that the hash (like CRC32) changes as well? – Gleno Sep 30 '11 at 3:19
Differing block sizes could cause a minor change in actual file size, but the contents of the file shouldn't change. – user55325 Sep 30 '11 at 4:20
@Gleno: Just FYI, but CRC32 is not a real "hash" and is easy to collide. For file integrity, MD5 or SHA are better. – grawity Sep 30 '11 at 8:59
@grawity, the probability that two different files output same CRC32 is low enough. You are right in that there exist better hashes, but CRC32 is a very common check for file integrity. – Gleno Sep 30 '11 at 9:47
@Gleno: Yes, but only against accidental corruption, not malware. (Unrelated, but interesting: many Microsoft-distributed ISOs have FFFFFFFF as their CRC32.) – grawity Sep 30 '11 at 10:00
up vote 4 down vote accepted

If transferring an executable from system A to system B changes it in some way, and transferring it back to system A apparently changes it back, then I'd say it a common sign of a virus infection. That is, the EXE file is infected. However, on the original system (A) this virus is active, and makes the file size to be reported as it was originally. However, checking the copied file on a "clean" system (B) you can see the difference.

My advice is, upload the EXE file from system B (where the file appears to be bigger) to VirusTotal, which will have it checked with many antiviruses simultaneously, in a matter of minutes. If the file is infected, you'll most probably know it.

share|improve this answer
Can you elaborate as to why a virus would make a file appear larger on a system? Theoretically, I guess I could see how it could affect what a utility might display as a size. Am I missing another possibility? – Belmin Fernandez Oct 2 '11 at 4:18
When a virus infects a file, it adds its payload to it, so the file grows. To avoid detection, on an infected system (where the virus is resident and active), it shows the filesize as it was before infection. But if you copy that file to a clean system, you see its true size, which is what it was before it got infected plus the size of the virus payload. – haimg Oct 2 '11 at 4:32
Curiosity: Are you aware of how a virus is able to control what size is reported for a file? – Belmin Fernandez Oct 2 '11 at 4:35
Yes. I worked in an antivirus company many years ago. Basically you write a filesystem filter driver... Then you can do all kinds of "funny" stuff, e.g. return different file size depending on who's asking, etc. – haimg Oct 2 '11 at 4:42
Thanks for the insight! +1, interesting stuff. Sorry for the tangent :-) – Belmin Fernandez Oct 2 '11 at 13:37

In the past I have experienced issues with CR/LF -> CR conversion, or ASCII/binary transfer mode conflicts in numerous file transfer contexts. If the virus payload theory doesn't pan out, you might want to go down this path to see if this is happening in your case.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .