🚀 go-pugleaf

monta_l@dist.dist.unige.it (Marco Gualdi) writes:

> I need a TSR runtime scanner with the ability to scan for a single
> userdefined virus signature. 

Try TbScanX. You can get it from Simtel20 or its mirrors:
oak.oakland.edu:pub/msdos/trojan-pro/tbscnx31.zip (unless a later
release is available, of course).

> I'm able to compile e/o assemble a
> similar program, so the sources are agreed.

No sources, sorry.

> I have a lot of problem
> with the Stanco virus (a local production, I suppose). Bontchev, Frisk
> and McAfee know it, but no scanner recognize it, jet.

F-Prot 2.05 recognizes it too well, alas... It even reports a false
positive in some PKLited files. :-( Should be fixed in version 2.05a.

BTW, both F-Prot and SCAN allow the user to use scan strings defined
by him/herself. However, if you decide to do so, be careful not to
fall in the same trap that Frisk did - it is very difficult to select
a scan string for this virus that will not cause false positives,
since the virus is PKLited itself...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany