CPAV leftovers: summary (PC)

Thread View: comp.virus

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by Luca Parisi Sat, 19 Dec 1992 22:15

#4183

Author: Luca Parisi
Date: Sat, 19 Dec 1992 22:15

24 lines
1428 bytes

Here is what I've found out about the "leftovers" I mentioned.

The "CARMEL Software" string is indeed added to files by the
"Immunize" option of Central Point Anti Virus 1.0 and 1.2 (At least; I
could only find those versions, and the new Windows one that has no
such option).

It is not part of the integrity checking program, however. It seems to
be used to pad the executable file to a multiple of 16 before adding
the self-checker, but only under certain conditions (I was unable to
replicate it except on NU.EXE, and I found another padding string
elsewhere).  It is not deleted by the "Remove Immunization" option,
although the file is restored to its original size. The padding string
and a copy of the first bytes of the original immunized program can be
read in the slack space and will disappear as expected when the
deimmunized file is copied.

The user who originally faced the program had indeed used CPAV, not 
the original CARMEL product.

Thanks to those who supported me with suggestions.

Luca Parisi 
<MC1980@mclink.it>

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads