Sophos Anti-Virus for Windows 2000+: buffer overflow prevention system significant files and registry entries

Buffer overflow protection is deployed in this file.

Location: C:\Program Files\Sophos\Sophos Anti-Virus

In supported versions of Windows, the location of Sophos_detoured is recorded in: HKLM\Software\Microsoft\Windows NT\Current Version\Windows\AppInit_Dlls

The registry string value is space-separated and contains a list of libraries to load when Windows applications are launched. If Sophos_detoured.dll is not in the list, the buffer overflow protection system will not load. When an application is launched, Sophos_detoured.dll is loaded inside of the new process. If this application should not be protected, Sophos_detoured will unload.

Buffer overflow protection configuration is contained in a single, obfuscated file.

Location: C:\Documents and Settings\All Users\Application Data\Sophos\Sophos Anti-Virus\Config\config.bops