I'm trying to restore a file that was infected by a virus (gaelicum or tenga)

It's an appending virus.

This is the warning I get when opening it in OllyDbg

: ---------------------------
Entry Point Alert
Module 'SUPER_GAY_NIGGERS' has entry point outside the code (as specified in the PE header). Maybe this file is self-extracting or self-modifying. Please keep it in mind when setting breakpoints!

My questions are:

  1. How can I figure out what was the original Entry Point?
  2. How can I restore the original entry point once I recover it?
  • 1
    It isn't too clear what you actual question is - are you trying to discover what was the previous entry point? are you trying to figure out how to change an executable's entry point? both? – NirIzr Oct 16 '16 at 2:39
  • yeeeeeeeeeeee both – BingBang32 Oct 16 '16 at 8:26

It is important to do the entire process inside a virtual machine to avoid any additional file infections and/or suffer the malicious effects of the virus.

Finding the original entry point

This is not a trivial task, since once the PE's entry point changes it is no longer recorded anywhere in the PR header. The only way to find the original entry point is through debugging the PE's execution throughout the malicious code added, until the additional code reaches to the original entry point.

Doing that depends heavily on how complex and protected the malicious code is. A simple approach (that might work) could be using a debugger such as ollydbg to run the code until it reached the original code's memory region (this can be done by opening the memory window and pressing f12 after selecting the relevant memory regions).

If the malicious code implements any anti-debugging protections you might need to bypass those.

Changing the entry point back

If you've used ollydbg in the previous part, you could use PE dump plugin (OllyDumpEx for example) to dump the PE with the entry point by using the plugin when EIP points to that entry point.

Alternatively, you can use any PE editing tool (like PEExplorer, LordPE or CFFExplorer) or advanced hex editor (My personal preference is 010Editor) to edit the Entry Point field in the PE header directly.

Removing residues

Although the malicious code should no longer run it is still inside your file. As an optional third step, you might want to remove the file infector's residue. According to the error message, it seems the file infector added it's own section, so by using a PE editor you could remove that new section in order to remove at least most of the virus's residues in your file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.