... | ... |
@@ -741,22 +741,6 @@ int cli_scanpe(cli_ctx *ctx) |
741 | 741 |
return CL_CLEAN; |
742 | 742 |
} |
743 | 743 |
pe_plus = 1; |
744 |
- } else { |
|
745 |
- /* |
|
746 |
- either it's got a PE32_SIGNATURE or |
|
747 |
- we enable win9x compatibility in that we don't honor magic (see bb#119) |
|
748 |
- either way it's a 32bit thingy |
|
749 |
- */ |
|
750 |
- if(EC16(optional_hdr32.Magic) != PE32_SIGNATURE) { |
|
751 |
- if(!ctx->corrupted_input) |
|
752 |
- cli_warnmsg("Incorrect magic number in optional header\n"); |
|
753 |
- if(DETECT_BROKEN_PE) { |
|
754 |
- if(ctx->virname) |
|
755 |
- *ctx->virname = "Heuristics.Broken.Executable"; |
|
756 |
- return CL_VIRUS; |
|
757 |
- } |
|
758 |
- cli_dbgmsg("9x compatibility mode\n"); |
|
759 |
- } |
|
760 | 744 |
} |
761 | 745 |
|
762 | 746 |
if(!pe_plus) { /* PE */ |