Article View: comp.virus
Article #4184Another Kind Of Droppers (PC)
From: Luca Parisi
Date: Sat, 19 Dec 1992 22:15
Date: Sat, 19 Dec 1992 22:15
24 lines
1559 bytes
1559 bytes
Not much time ago, a posting by Stefano Turci (Stefano_Turci@ f108.n391.z9.virnet.bad.se) prompted discussion about the fact that converting a file from .COM to .EXE caused scanners not to recognize some virus infections any more. I don't have much to object to the views expressed by the scanners themselves (well, actually their authors :-) but I faced the same problem while dealing with the "leftovers" of my previous posting. That is, files infected with virus 855 (Nov. 17th) and subsequently immunized with CPAV 1.2 are not recognized as such by F-Prot 2.06, Scan 97 or VirX 2.4 (I know they are not entirely up-to-date, but all three recognize the 'vanilla' infection on the same files). I don't think this is more than an "academic" problem unless the current DOS version of CPAV still offers immunization, and a bit more if the rumored MSDOS 6.0-bundled one does (the most recent plain DOS CPAV I have is 1.2, and WinCPAV doesn't). More generally, I'd say that the integrity check should be a built-in function, otherwise it can only build false security. But somebody here must have said that before and better than me... Luca Parisi <MC1980@mclink.it>
Technical Details
Message-ID:
<0002.9212221358.AA03720@barnabas.cert.org>Path:
arc1-ca.pugleaf.net!sparky!uunet!gatech!darwin.sura.net!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!newsShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!gatech!darwin.sura.net!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news From: MC1980@mclink.it (Luca Parisi) Newsgroups: comp.virus Subject: Another Kind Of Droppers (PC) Message-ID: <0002.9212221358.AA03720@barnabas.cert.org> Date: 19 Dec 92 22:15:35 GMT Sender: virus-l@lehigh.edu Lines: 24 Approved: news@netnews.cc.lehigh.edu