question about viruses attacking exe (install) files

[jimdagys]

My computer was pretty virused and rootkitted up and I used Ghost to restore the C drive. After restoring, however, I noticed a few virus files on the D and E drive hidden in various folders. When I opened the folders, the McAfee popped up and deleted them. I also have exe (install) files on the E drive. When I tried to install some of these programs, I got error messages. I know these exe files were fine before the virus attack. But somehow the viruses corrupted the exe files. I deleted the exe files and copied them back on the E drive from a back-up cd. Now the exe files work fine. My question is, how can viruses corrupt exe files? Also, if I put the exe files in a winrar archive, will that simple process protect the exe files from getting corrupted from viruses?

[guns1inger]

Most virii seek out exe files to help them spread. It is the easiest way to get into memory - hitch a ride on a program when it executes. This is how virii have propagated since the earliest versions.

Will putting the exe inside a rar archive protect it ? From some virii, yes, but maybe not from all of them.

[jimdagys]

Typically, when do the viruses attack the exe file? If viruses are present in a computer, can they attack the exe files at anytime, or do they attack during startup/shutdown of Windows? Those exe files on my computer that were attacked and then would not install, is that a safety mechanism in the exe that will not allow installation if the exe has been tampered with? Also, my McAfee did not alert me that these exe files had been attacked by viruses. (But the evidence was clear because the exe's would not install. ) Suppose I tried to attach this infected exe to my yahoomail (which scans all attachments). Would yahoomail alert me that the file is infected? Is there any other simple web based utility that I can use to check and see if a file is infected? I don't want something like Housecall that scans the whole computer, I just want to be able to check a file in question, like when attaching a file with yahoomail. I still have one more exe file on my E drive that went through the virus attack. But the exe file still installs fine and when attached to yahoomail (as a test), there is no alert. But as you said before, viruses attach to the exe file and then spread when the exe is executed. So I am not sure at this point whether this one exe file is infected or not. I would like to test it by another virus scanner (in addition to the yahoomail test).

[guns1inger]

It varies from virus to virus. Some actively seek out specific exe files and infect them. Others will infect any exe file when it is run by the user or a system task. Others may just seek out and infect any exe file they can find on the system.

It is also rare for an anti-virus program to successfully repair and infected file. It may well remove the virus from an exe, but usually the exe is too damaged, either by the virus or the anti-virus program to ever be able to run again.

Use one of the free online scans if you no longer trust McAfee (never been a big fan of it myself), and see what it says.

[usually_quiet]

I have been using AVG Free Edition for almost a year. They have pay versions as well, of course. One has an integrated firewall. If you want to ditch McAffee, it's an alternative you can try at a very reasonable price.

When I installed it, it found a few things that Norton missed, so I'd say it's fairly decent, and you can scan individual files/folders with it. ...but perhaps I'm not the best one to give a testimonial since I almost never receive infected files.