Xref: news-dnh.mv.net comp.os.msdos.djgpp:1754
Path: news-dnh.mv.net!mv!news.sprintlink.net!howland.reston.ans.net!math.ohio-state.edu!news.cyberstore.ca!nntp.cs.ubc.ca!unixg.ubc.ca!news.bc.net!rover.ucs.ualberta.ca!news.ucalgary.ca!srv1.freenet.calgary.ab.ca!choang
From: Chi Hoang <choang AT freenet DOT calgary DOT ab DOT ca>
Newsgroups: comp.os.msdos.djgpp
Subject: Re: djgpp2 and TBAV
Date: Fri, 25 Aug 1995 19:41:14 -0600
Organization: Calgary Free-Net
Lines: 21
References: <DDvEG2 DOT 41u AT jade DOT mv DOT net> <mictaliDDvHxL DOT 84w AT netcom DOT com> <Pine DOT A32 DOT 3 DOT 91 DOT 950825122621 DOT 15802A-100000 AT srv1 DOT freenet DOT calgary DOT ab DOT ca> <303e5067 DOT sandmann AT praline DOT no DOT NeoSoft DOT com>
Nntp-Posting-Host: choang AT srv1 DOT freenet DOT calgary DOT ab DOT ca
To: djgpp AT sun DOT soe DOT clarkson DOT edu
Dj-Gateway: from newsgroup comp.os.msdos.djgpp



On Fri, 25 Aug 1995, Charles Sandmann wrote:

> If someone posts what the bug in TBAV is, maybe an alternate way of linking
> can workaround the bug.  There is nothing virus-like in the stub to trigger
> such a warning.  The source is available for the stub, so someone with this 
> buggy scanner needs to find out what it doesn't like.
> 
well, this is what TBAV says on all djgpp2 programs:
 Heuristic flags: c!?ZK AT i
 c  No checksum / recovery information (Anti-Vir.Dat) available. 
 !  Invalid opcode (non-8088 instructions) or out-of-range branch. 
 ?  Inconsistent exe-header.  Might be a virus but can also be a bug. 
 Z  EXE/COM determination.  The program tries to check whether a file
    is a COM or EXE file.  Viruses need to do this to infect a program. 
 K  Unusual stack.  The program has a suspicious stack or an odd stack. 
 @  Encountered instructions which are not likely to be generated by
    an assembler, but by some code generator like a polymorphic virus. 
 i  Additional data found at end of file. Probably internal overlay.