Path: utzoo!utgpu!news-server.csri.toronto.edu!bonnie.concordia.ca!thunder.mcrcim.mcgill.edu!snorkelwacker.mit.edu!usc!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: jguo@cs.NYU.EDU (Jun Guo)
Newsgroups: comp.virus
Subject: Compressors
Message-ID: <0011.9102061308.AA27330@ubu.cert.sei.cmu.edu>
Date: 6 Feb 91 06:55:05 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 30
Approved: krvw@sei.cmu.edu

Hi,

   We know that signature based scanner will not search into compressed
EXE/COM file. So if we have decompressors we should decompress the file
and then apply virus scanner on it.

   The following is a list of EXE/COM compressors I heard of:
   compressor:                    decompressor:
      LZEXE                         UNLZEXE
      PKlite                        PKlite -x
      Diet 1.0                      Diet -r
      LEXEM
      TinyProg
      EXEPACK                       UPACKEXE
      AXE
      Shrink
      SCRNCH
      ICE                           ICE breaker
      CRUNCH

   I'd like to hear from you of other compressors and decompressors.

   And one more thing: how are device drivers loaded? Can they be
compressed also? If yes, how can we decompress that?

   Many thanks.

Jun

P.S.: I just heard of there is ICE breaker. But never seen that.