In Message-ID:<970263D544D6617E53A@66.250.146.159>
JS <j_simmonmds@nomailthankyou.com> wrote:

>I wanted to get more info about this file, so I disabled it by
>adding a couple of random letters to the extension.
>
> I renamed BLUESKY.EXE to BLUESKY.EXEHJ.
>
>I figured this would stop my XP Pro from running it if I double
>clicked it by mistake. But my antivirus guard 'AntiVir PE' warned
>me about it again. Even with the dummy extension letters! Surely
>such a program file is now safe enough?
>
>--
>
>I found that if I add the random letters *before* the EXE then
>AntiVir PE's guard does not detect it as a virus.
>
>So BLUESKY.HJEXE is ok according to 'AntiVir PE'.

The extension on the 8.3 filename will have the 1st 3 chars
of the final extension. Thus bluesky.exehj will have an 8.3 name
of something like bluesk~1.exe which is an executable.

To see this, use DIR *.EXE* /X from a command prompt.


--
Arthur T. - ar23hur "at" speakeasy "dot" net
Looking for a good MVS systems programmer position