Depending on the actual chronology, you might be able to use an old version of f-prot to remove the PKLite container.
The first versions of f-prot's heuristic virus removal software considered PKLite's method of jumping around to replace the PKLite code with the original code entry point to be a viral behaviour, and happily decompressed the binary and stripped off the PK container straight off. Sometimes it left crud on the end, but that didn't harm anything.
Needless to say, both FRISK and PK updated their code to not trample or trigger each other.
"PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved" right there at the front. And I can see a lot of scrambled text that is exactly what one would expect to see from a PKLite compressed executable:
OGRIDLOK regi
Pstration prog
J.Acker
ma2(c) 1993:
Select YES if y
ou have a
Pde, NO to exi
InfoN
CITh/CB
imu$
send3
R10z:U
oNo}dhoek&
17985+
Town.
Lca?
I will
CODE
<Ousing
unlock-
r leve
@&e.2
You won't be patching it without decompressing it. Unless you run it under something that patches it in memory for every time it is executed. But that's a ridiculous amount of work.
See if F-Prot will decompress and remove the container, and then go from there. Make sure it's an early version of f-prot. It does look like an early PKLite, so you just might pull it off.
Comments
Depending on the actual chronology, you might be able to use an old version of f-prot to remove the PKLite container.
The first versions of f-prot's heuristic virus removal software considered PKLite's method of jumping around to replace the PKLite code with the original code entry point to be a viral behaviour, and happily decompressed the binary and stripped off the PK container straight off. Sometimes it left crud on the end, but that didn't harm anything.
Needless to say, both FRISK and PK updated their code to not trample or trigger each other.
I don't believe I packed the .EXE
It is PKLite compressed. I looked already.
"PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved" right there at the front. And I can see a lot of scrambled text that is exactly what one would expect to see from a PKLite compressed executable:
... etc ...mmm, I don't remember doing that. But was uploading to BBS's at the time so may have done so. Also may have been trying to dissuade cracking :)
You won't be patching it without decompressing it. Unless you run it under something that patches it in memory for every time it is executed. But that's a ridiculous amount of work.
See if F-Prot will decompress and remove the container, and then go from there. Make sure it's an early version of f-prot. It does look like an early PKLite, so you just might pull it off.
Do you have any prepped GRIDLOK.REG files lying around?
Unfortunately not :(