Central Point Anti-Virus immunized file - Revision history

Jsummers: /* Software */

2025-03-27T14:03:18Z

‎Software

Jsummers at 14:15, 16 February 2025

2025-02-16T14:15:19Z

Jsummers: Created page with "{{FormatInfo |formattype=electronic |subcat=Executable envelopes |released=≤1991 }} Some versions of Central Point Anti-Virus have an "immunize file" feature that can modify..."

2025-02-15T12:50:25Z

Created page with "{{FormatInfo |formattype=electronic |subcat=Executable envelopes |released=≤1991 }} Some versions of Central Point Anti-Virus have an "immunize file" feature that can modify..."

New page

{{FormatInfo
|formattype=electronic
|subcat=Executable envelopes
|released=≤1991
}}
Some versions of Central Point Anti-Virus have an "immunize file" feature that can modify [[MS-DOS EXE|DOS EXE]] and [[DOS executable (.com)|COM]] executable files, to insert a tamper-detection feature. This article describes these modified files.

''[Ed. note: We're guessing it's the "immunize" function that creates the files described here, but this needs to be verified.]''

== Identification ==
Immunized COM files are observed to start with 14 bytes having the following pattern: {{magic|e9 ?? ?? 00 ?? ?? 22 19 35 93 59 57 54 80}}.

Immunized EXE files have a certain byte pattern starting at the ''entry point'' (refer to [[MS-DOS_EXE#Special file positions]]): {{magic|e8 20 00}}, then 32 bytes copied from the original file, then {{magic|5b 81 eb 03 01 50 51 52 ...}}.

All files contain text strings such as "{{magic|Central Point Anti-Virus (c) 1991 CPS}}" and "{{magic|Self Integrity Check warning}}", but they may differ by version.

== Software ==
* [https://winworldpc.com/product/central-point-anti-virus/1x Central Point Anti-Virus 1.x], at WinWorld

== Sample files ==
* {{CdTextfiles|640swstudio/UTILITY/IDEID.ZIP|IDEID.ZIP}} → *.COM
* {{CdTextfiles|640swstudio/BASIC/PBPOPSI.ZIP|PBPOPSI.ZIP}} → *.EXE
* {{CdTextfiles|smsharew/MUSIC/MUSICS.ZIP|MUSICS.ZIP}} → *.EXE, *.COM

@@ Line 16: / Line 16: @@
 * [https://winworldpc.com/product/central-point-anti-virus/1x Central Point Anti-Virus 1.x], at WinWorld
 * [{{SACFTPURL|avmuseum|tnt814.zip}} Turbo Anti-Virus v8.14]
 == Sample files ==

@@ Line 4: / Line 4: @@
 |released=≤1991
 }}
-Some versions of Central Point Anti-Virus have an "immunize file" feature that can modify [[MS-DOS EXE|DOS EXE]] and [[DOS executable (.com)|COM]] executable files, to insert a tamper-detection feature. This article describes these modified files.
+Some versions of Central Point Anti-Virus, and Turbo Anti-Virus by Carmel Software (from which Central Point Anti-Virus was derived), have an "immunize file" feature that can modify [[MS-DOS EXE|DOS EXE]] and [[DOS executable (.com)|COM]] executable files, to insert a tamper-detection feature. This article describes these modified files.
-−
-''[Ed. note: We're guessing it's the "immunize" function that creates the files described here, but this needs to be verified.]''
 == Identification ==
@@ Line 13: / Line 11: @@
 Immunized EXE files have a certain byte pattern starting at the ''entry point'' (refer to [[MS-DOS_EXE#Special file positions]]): {{magic|e8 20 00}}, then 32 bytes copied from the original file, then {{magic|5b 81 eb 03 01 50 51 52 ...}}.
-All files contain text strings such as "{{magic|Central Point Anti-Virus (c) 1991 CPS}}" and "{{magic|Self Integrity Check warning}}", but they may differ by version.
+All files contain text strings such as "{{magic|Central Point Anti-Virus (c) 1991 CPS}}" or "{{magic|CARMEL Software Engineering - Turbo Anti-Virus(tm)"}}, and "{{magic|Self Integrity Check warning}}", but they differ by version.
 == Software ==
 * [https://winworldpc.com/product/central-point-anti-virus/1x Central Point Anti-Virus 1.x], at WinWorld
 == Sample files ==
@@ Line 22: / Line 21: @@
 * {{CdTextfiles|640swstudio/BASIC/PBPOPSI.ZIP|PBPOPSI.ZIP}} → *.EXE
 * {{CdTextfiles|smsharew/MUSIC/MUSICS.ZIP|MUSICS.ZIP}} → *.EXE, *.COM