Central Point Anti-Virus immunized file
Some versions of Central Point Anti-Virus have an "immunize file" feature that can modify DOS EXE and COM executable files, to insert a tamper-detection feature. This article describes these modified files.
[Ed. note: We're guessing it's the "immunize" function that creates the files described here, but this needs to be verified.]
Identification
Immunized COM files are observed to start with 14 bytes having the following pattern: e9 ?? ?? 00 ?? ?? 22 19 35 93 59 57 54 80.
Immunized EXE files have a certain byte pattern starting at the entry point (refer to MS-DOS_EXE#Special file positions): e8 20 00, then 32 bytes copied from the original file, then 5b 81 eb 03 01 50 51 52 ....
All files contain text strings such as "Central Point Anti-Virus (c) 1991 CPS" and "Self Integrity Check warning", but they may differ by version.
Software
- Central Point Anti-Virus 1.x, at WinWorld
Sample files
- IDEID.ZIP → *.COM
- PBPOPSI.ZIP → *.EXE
- MUSICS.ZIP → *.EXE, *.COM
