Re: SCAN 95b doesn't find MtE in EXE files (PC)

Article View: comp.virus

Article #3091

#3091

From: a_rubin
Date: Thu, 05 Nov 1992 00:00

16 lines
1164 bytes

Stefano_Turci@f0.n462.z9.virnet.bad.se (Stefano Turci) writes:

>The conversion is very simple, in fact COMTOEXE adds 32 bytes long
>header at the top of the file, and the CS:IP points to the first byte
>after the header.

Does this work?  I though you needed to reset segment registers for
the converted program to run.  If not, I can understand why the
scanners don't detect it (although they should detect as a "varient"
or "dropper".)

- --
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; please mail anything important

Technical Details

Message-ID: <0006.9211101943.AA07075@barnabas.cert.org>

Path:

arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!darwin.sura.net!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!darwin.sura.net!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: a_rubin@dsg4.dse.beckman.com
Newsgroups: comp.virus
Subject: Re: SCAN 95b doesn't find MtE in EXE files (PC)
Message-ID: <0006.9211101943.AA07075@barnabas.cert.org>
Date: 5 Nov 92 00:00:28 GMT
Sender: virus-l@lehigh.edu
Lines: 16
Approved: news@netnews.cc.lehigh.edu