[comp.virus] Compressors

jguo@cs.NYU.EDU (Jun Guo) (02/06/91)

Hi,

   We know that signature based scanner will not search into compressed
EXE/COM file. So if we have decompressors we should decompress the file
and then apply virus scanner on it.

   The following is a list of EXE/COM compressors I heard of:
   compressor:                    decompressor:
      LZEXE                         UNLZEXE
      PKlite                        PKlite -x
      Diet 1.0                      Diet -r
      LEXEM
      TinyProg
      EXEPACK                       UPACKEXE
      AXE
      Shrink
      SCRNCH
      ICE                           ICE breaker
      CRUNCH

   I'd like to hear from you of other compressors and decompressors.

   And one more thing: how are device drivers loaded? Can they be
compressed also? If yes, how can we decompress that?

   Many thanks.

Jun

P.S.: I just heard of there is ICE breaker. But never seen that.

frisk@rhi.hi.is (Fridrik Skulason) (02/08/91)

jguo@cs.NYU.EDU (Jun Guo) writes:
>   We know that signature based scanner will not search into compressed
>EXE/COM file.

Not 100% correct - some scanners will scan some types of compressed
files simply by uncompressing them first - for example my F-PROT, and
(I think) McAfee's SCAN will scan a LZEXE-packed file.

Of course I want to make my scanner be able to scan all the different
types of compressed files - the problem is just that I don't have a
copy of all the compressors - in fact, I only have LZEXE and EXEPACK.
I know some of the compressors are available on SIMTEL20 and
elsewhere, but not all.  So, could somebody mail me information on the
status of the programs below - are they shareware/freeware/commercial,
and where are they available ?

No need to increase the traffic on Virus-L too much...I will post a
summary of the replies I receive.

>      PKlite                        PKlite -x
>      Diet 1.0                      Diet -r
>      LEXEM
>      TinyProg
>      AXE
>      Shrink
>      SCRNCH
>      ICE                           ICE breaker
>      CRUNCH

>   I'd like to hear from you of other compressors and decompressors.

I know of one program from Bulgaria - perhaps Vesselin Bontchev could
provide some information on it - the problem is just that he does not
have a computer any more, as he was just promoted.

>   And one more thing: how are device drivers loaded? Can they be
>compressed also? If yes, how can we decompress that?

I know of no method to compress device drivers, which allows them to
be uncompressed dynamically on loading - it could be written, of
course, but I don't think it is worth the effort - device drivers are
usually so small (less than 50 Kbytes) one does not gain much in space
or loading time.