PIF Files

[jbeitz107]

I have been infected multiple times with this Sality virus and have researched to understand that it is part of a botnet creation. I have gotten it from a game server that has repeatedly changed it's name in order to gain funds from players after closing it's previous server. They utilize it to take out their competitors because they feel threatened by competition.

So here is my question. I would like to better know how exactly .pif files are created and how exactly they work? Will somebody please explain this to me in detail?

Thank you.

 

[Mucski]

Literaly the whole story about it and why it can be a virus can be found on wikipedia. https://en.wikipedia.org/wiki/Program_information_file

 

[jbeitz107]

I have a basic understanding but, I want to know more about how it is made. Thanks

 

[Joopie]

Wel, according to Wikipedia, quoted below, a PIF is executed by its content and not the extention.
In other words a PIF can be executed as a executable.

Although a file in PIF format does not contain any executable code (it lacks executable files' magic number "MZ"), Microsoft Windows handles all files with (pseudo-)executables' extensions in the same manner: all .COMs, .EXEs, and .PIFs are analyzed by the ShellExecute function and will run accordingly to their content and not extension, meaning a file with the PIF extension can be used to transmit computer viruses.