Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!zaphod.mps.ohio-state.edu!ub!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: frisk@rhi.hi.is (Fridrik Skulason) Newsgroups: comp.virus Subject: Re: LZEXE - a possible anti virus application (PC) Message-ID: <0004.9012101454.AA21256@ubu.cert.sei.cmu.edu> Date: 7 Dec 90 20:55:16 GMT Sender: Virus Discussion List Lines: 22 Approved: krvw@sei.cmu.edu tfarrell@lynx.northeastern.edu writes: >The really neat part, >though, is that it includes a self-check into every file compressed >with the utility, so that if the file has been changed it will notify >you. This would detect the presence of a virus in the software. No...no...no... Remember - if the program is infected after it is LZEXEd, then the virus will be activated first, when the program is executed. If it is a "stealth" type virus, the LZEXE self-test is useless, as the infected program will appear uncorrupted. On the other hand, if the program is first infected, and then LZEXEd, the main effect will be that the majority of current anti-virus programs will not detect the virus. McAfee's SCAN will, and my own F-PROT, but I know of no other programs capable of scanning LZEXE-packed files. This is a nice program, but not of much use against viruses... - -frisk