Description: PE file is windows (95/98/NT) is currently used in the executable file format. CIH virus is prevalent PE by changing the contents of the file, and keep the file size unchanged, and thus realize their functions. This procedure by analyzing the PE file format, the executable file to re-positioning table positioning, pointing users to the preparation of the DLL, and then return to normal call instruction pointer location. Adopted in the DLL system linking all levels realize the background of the intercepted password function.
File list (Check if you may need any files):
Download