Path: utzoo!attcan!uunet!samsung!usc!wuarchive!udel!rochester!uhura.cc.rochester.edu!ub!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: davidsen@crdos1.crd.ge.COM (Wm E Davidsen Jr)
Newsgroups: comp.virus
Subject: Re: LZEXE - a possible anti virus application (PC)
Message-ID: <0002.9012122103.AA25390@ubu.cert.sei.cmu.edu>
Date: 11 Dec 90 15:26:46 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 21
Approved: krvw@sei.cmu.edu

frisk@rhi.hi.is (Fridrik Skulason) writes:

| On the other hand, if the program is first infected, and then LZEXEd,
| the main effect will be that the majority of current anti-virus
| programs will not detect the virus. McAfee's SCAN will, and my own
| F-PROT, but I know of no other programs capable of scanning
| LZEXE-packed files.
|
| This is a nice program, but not of much use against viruses...

  I'm not sure that's correct... the steath virus will return an
uncorrupted copy of the program when read by a checking program, and
presumably this is what gets compressed by lzexe.

  I read it as making the non-stealth harder to find, and eliminating
the stealth completely.

  Comments?
- --
bill davidsen	(davidsen@crdos1.crd.GE.COM -or- uunet!crdgw1!crdos1!davidsen)
    VMS is a text-only adventure game. If you win you can use unix.