
           First-Section File Infector (VX Library). Freeware
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

     OLD FILE:         NEW FILE:               Infection Method:
   (PE exe/dll)                                ~~~~~~~~~~~~~~~~~
 Ŀ  Ŀ
  MZ-header       MZ-header        2nd part of file (from CODE section)
  PE-header       PE-header         is displaced down
  object table    object table    virus is inserted into file between
 .CODEĴ  .CODEĴ      end-of-headers and first section
  [CODE]         [VIRUS]      Ĵ file to infect must have relocations
  old_entry:     new_entry:   Ĵ all relocations within all the file
 Ĵ  jmp old_entry    are modified
  .DATA, ...    - - - - - - -     PE hdr & .reloc section are modified
  [CODE]           resources (.rsrc), imports/exports
                    old_entry:          are modified if present
                   Ĵ    all file io using FileMapping
                    .DATA, ...       datetime/file attribs are preserved,
                        except time is increased by 2 sec.



                   (x) 2000 Z0MBiE, http://z0mbie.cjb.net
