DOS ain't dead - HX full of virii

HX full of virii (DOSX)

posted by Rugxulo , Usono, 23.11.2012, 00:24

> > Horrible that we have to work around lousy antiviruses
>
> > (I didn't check, but IMHO, putting the password as plaintext in the .ZIP
> > comment would at least be semi-friendly
>
> Better idea:
>
> - switch form ZIP to 7-ZIP

Won't work. Most good ones can unpack various archives and exe packers, esp. the open source kind (.7Z).

> - brew a better PWD than "japheth" and hide it better

.ZIP passwords are incredibly easy to crack. Also, it's a pain trying to remember a billion passwords. If the "PX" hack isn't viable, I'll understand, but so far it seems like the least painful way to fix everything, at least in my naive worldview.

Or just only password protect DKRNL32.DLL and leave others unencrypted. Then the README.1ST could tell the password to unpack the remaining file.

Or just split the actual file into several pieces and let the user manually combine it (hopefully defeating detection).

> - hide your HX files into something else looking innocent (PNG? OGV? ...)

I don't think that will work. Lots of formats have subformats inside them, so smart antiviruses probably still scan them for various things.

> Hints about suitable tools
> (usable in DOS) are
> welcome :hungry:

There was an old one on FASM's forum a few years ago, perhaps by ATV, but I don't remember where. Feel free to search.

> > You could probably also just disable heuristics entirely or choose
> "ignore"
> > to manually ignore the warning (e.g. XPACK/Gen or whatever for
> > TESTDRUG.EXE below)
>
> I don't have any problems with the file. Maybe because I don't use those
> useless "antivirii" at all?

They aren't useless, just overzealous and bloated and slow. It's a sad fact of life.

Post reply

Complete thread:

HX bugs - DOS386, 19.12.2009, 14:26 (DOSX)
- OLEeeee, OLEeeeeeeee - 1 more bug - "StringFromGUID2" - DOS386, 20.12.2009, 07:45
  - OLEeeee, OLEeeeeeeee - 1 more bug - "StringFromGUID2" - Japheth, 20.12.2009, 16:45
    - HX 2.17 improvements | even one more bug - DOS386, 21.12.2009, 08:50
- GPF in "GetProcessHeapEx" | trun in "GetExitCodeProcess" - DOS386, 24.12.2009, 09:59
  - GPF's | buggy thing | "CreateProcessA" | ZERO'izing FS - DOS386, 25.12.2009, 16:16
    - GPF's | buggy thing | "CreateProcessA" | ZERO'izing FS - Japheth, 28.12.2009, 16:37
      - GPF's | buggy thing | "CreateProcessA" | ZERO'izing FS - DOS386, 29.12.2009, 09:39
        6 more bugs | PETITE | DGDI32.DLL | docs sugx - DOS386, 17.03.2010, 06:02
        6 more bugs | PETITE | DGDI32.DLL | docs sugx - Japheth, 18.03.2010, 08:59
        6 more bugs | PETITE | DGDI32.DLL | docs sugx - DOS386, 06.06.2010, 16:04
        discovered 3 more buggs - DOS386, 14.07.2010, 14:38
        discovered 3 more buggs - Japheth, 17.07.2010, 15:58
        discovered 3 more buggs - DOS386, 23.07.2010, 07:33
- Generic horse power 15.CHINA for HX :-) - DOS386, 23.05.2010, 07:07
- HX bugs - DOS386, 17.11.2010, 04:43
  - HX bugs - DOS386, 17.11.2010, 05:26
    - HX bugs | GNASH - DOS386, 27.12.2010, 09:25
      - HX bugs | GNASH - DOS386, 28.12.2010, 07:52
- HX bugs - innounp - DOS386, 18.02.2011, 05:03
  - HX issues | MUH-pdf | Is Processor Feature Present - DOS386, 19.02.2011, 11:58
    - HX issues | MUH-pdf | Is Processor Feature Present - Japheth, 19.02.2011, 12:48
- HX bugs | PETITE & 7-ZIP PF in Ring0 - DOS386, 03.07.2011, 11:18
  - HX bugs | PETITE & 7-ZIP PF in Ring0 - Japheth, 03.07.2011, 20:01
    - HX bugs | missing imports | Dillo | MUPDF | TryEnter - DOS386, 20.11.2011, 04:33
      - HX bugs 2 more | ME bugs 1'000'000'000 more - DOS386, 24.11.2011, 06:11
        HX updated - DOS386, 20.11.2012, 11:34
        HX updated - Rugxulo, 22.11.2012, 05:56
        HX updated - Japheth, 22.11.2012, 07:03
        HX updated - Rugxulo, 22.11.2012, 09:32
        HX updated - Rugxulo, 22.11.2012, 10:16
        HX updated - Japheth, 23.11.2012, 09:13
        HX updated - Rugxulo, 25.11.2012, 07:09
        HX updated - george_breese, 07.01.2013, 18:43
        HX updated - Japheth, 08.01.2013, 08:44
        HX updated (5 years ago) ... but FFMPEG 1.1.1 works almost - DOS386, 08.02.2013, 10:50
        HX and INNOUNP (yeah: BUG isolated !!!) - DOS386, 08.02.2013, 14:41
        HX and INNOUNP (yeah: BUG isolated !!!) - Japheth, 09.02.2013, 08:48
        HX bugs (3 more) - DOS386, 10.04.2013, 12:08
        HX and MSVCRT.DLL - DOS386, 08.03.2014, 18:52
        HX and MSVCRT.DLL - Rugxulo, 23.03.2014, 06:47
        WINE and INNOUNP (and Delphi) - Rugxulo, 11.06.2015, 02:15
        HX full of virii - DOS386, 22.11.2012, 16:09
        HX full of virii - Rugxulo, 23.11.2012, 00:24
        HX full of virii - DOS386, 16.12.2012, 13:00
        HX (not) full of virii - Rugxulo, 16.12.2012, 22:07
        HX (not) full of virii - Japheth, 16.12.2012, 22:24
        HX (not) full of virii - Rugxulo, 17.12.2012, 21:59
        HX (not) full of virii - DOS386, 17.12.2012, 05:32
        HX (not) full of virii - Japheth, 17.12.2012, 08:47
        HX (not) full of virii - Rugxulo, 17.12.2012, 22:14
        HX (not) full of virii - Rugxulo, 18.12.2012, 20:55