🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.virus
Article #4184

Another Kind Of Droppers (PC)

#4184
From: Luca Parisi
Date: Sat, 19 Dec 1992 22:15
24 lines
1559 bytes
Not much time ago, a posting by Stefano Turci (Stefano_Turci@
f108.n391.z9.virnet.bad.se) prompted discussion about the fact that
converting a file from .COM to .EXE caused scanners not to recognize
some virus infections any more.

I don't have much to object to the views expressed by the scanners
themselves (well, actually their authors :-) but I faced the same
problem while dealing with the "leftovers" of my previous posting.

That is, files infected with virus 855 (Nov. 17th) and subsequently
immunized with CPAV 1.2 are not recognized as such by F-Prot 2.06,
Scan 97 or VirX 2.4 (I know they are not entirely up-to-date, but all
three recognize the 'vanilla' infection on the same files).

I don't think this is more than an "academic" problem unless the
current DOS version of CPAV still offers immunization, and a bit more
if the rumored MSDOS 6.0-bundled one does (the most recent plain DOS
CPAV I have is 1.2, and WinCPAV doesn't). More generally, I'd say that
the integrity check should be a built-in function, otherwise it can
only build false security.  But somebody here must have said that
before and better than me...

Luca Parisi 
<MC1980@mclink.it>
Technical Details
Message-ID: <0002.9212221358.AA03720@barnabas.cert.org>
Path: arc1-ca.pugleaf.net!sparky!uunet!gatech!darwin.sura.net!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!gatech!darwin.sura.net!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: MC1980@mclink.it (Luca Parisi)
Newsgroups: comp.virus
Subject: Another Kind Of Droppers (PC)
Message-ID: <0002.9212221358.AA03720@barnabas.cert.org>
Date: 19 Dec 92 22:15:35 GMT
Sender: virus-l@lehigh.edu
Lines: 24
Approved: news@netnews.cc.lehigh.edu