2 ms·
Depending on the actual chronology, you might be able to use an old version of f-prot to remove the PKLite container. The first versions of f-prot's heuristic
by ksaj 6y ago
Depending on the actual chronology, you might be able to use an old version of f-prot to remove the PKLite container.
The first versions of f-prot's heuristic virus removal software considered PKLite's method of jumping around to replace the PKLite code with the original code entry point to be a viral behaviour, and happily decompressed the binary and stripped off the PK container straight off. Sometimes it left crud on the end, but that didn't harm anything.
Needless to say, both FRISK and PK updated their code to not trample or trigger each other.
- Rabidgremlin 6y agoI don't believe I packed the .EXE
- ksaj 6y agoIt is PKLite compressed. I looked already. "PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved" right there at the front. And I can see a lot of scrambled text that is exactly what one would expect to see from a PKLite compressed executable: OGRIDLOK regi Pstration prog J.Acker ma2(c) 1993: Select YES if y ou have a Pde, NO to exi InfoN CITh/CB imu$ send3 R10z:U oNo}dhoek& 17985+ Town. Lca? I will CODE <Ousing unlock- r leve @&e.2 ... etc ...
- Rabidgremlin 6y agommm, I don't remember doing that. But was uploading to BBS's at the time so may have done so. Also may have been trying to dissuade cracking :)
- ksaj 6y agoYou won't be patching it without decompressing it. Unless you run it under something that patches it in memory for every time it is executed. But that's a ridiculous amount of work. See if F-Prot will decompress and remove the container, and then go from there. Make sure it's an early version of f-prot. It does look like an early PKLite, so you just might pull it off.
- ksaj 6y agoDo you have any prepped GRIDLOK.REG files lying around?
- Rabidgremlin 6y agoUnfortunately not :(