🚀 go-pugleaf

frisk@complex.is (Fridrik Skulason) writes:

> In my case the reson I miss this particular sample is simple.  I scan
> inside LZEXE-compressed files, but only for signatures - that is, I
> uncompress the virus in memory, and run my scanning engine over it.
> If I uncompressed to disk, and stripped off the COM/EXE conversion, I
> would detect it, but it would slow the scanner down considerably.

But why uncompressing it to disk? Can't you continue to do it in
memory? The scanner in Untouchable is able to scan inside multiply
compressed files (e.g., it can detect a virus that has been PKLITEd,
then LZEXEd, then ICEd, etc.), so it should be possible to do it...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany