Central Point Anti-Virus immunized file

File Format
Name	Central Point Anti-Virus immunized file
Ontology	Electronic File Formats Executable envelopes Central Point Anti-Virus immunized file
Released	≤1991

Some versions of Central Point Anti-Virus, and Turbo Anti-Virus by Carmel Software (from which Central Point Anti-Virus was derived), have an "immunize file" feature that can modify DOS EXE and COM executable files, to insert a tamper-detection feature. This article describes these modified files.

Identification

Immunized COM files are observed to start with 14 bytes having the following pattern: e9 ?? ?? 00 ?? ?? 22 19 35 93 59 57 54 80.

Immunized EXE files have a certain byte pattern starting at the entry point (refer to MS-DOS_EXE#Special file positions): e8 20 00, then 32 bytes copied from the original file, then 5b 81 eb 03 01 50 51 52 ....

All files contain text strings such as "Central Point Anti-Virus (c) 1991 CPS" or "CARMEL Software Engineering - Turbo Anti-Virus(tm)", and "Self Integrity Check warning", but they differ by version.

Software

• Central Point Anti-Virus 1.x, at WinWorld
• Turbo Anti-Virus v8.14

Sample files

• IDEID.ZIP → *.COM
• PBPOPSI.ZIP → *.EXE
• MUSICS.ZIP → *.EXE, *.COM
• tnt814.zip → *.COM, *.EXE (Turbo Anti-Virus)