Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Im trying to pack an Executable using an Exe Packer like UPX.I packed and checked the File with some 9 Antivirus Products say its a Virus actually its a harmless exe.I think the AV Engines which are based on Ikarus has problems like this. Why can't they check the file properly using better techniques before flagging it as a virus.

share|improve this question
What "better techniques" would you suggest? – bobince Jun 26 '12 at 7:07
up vote 2 down vote accepted

I believe some of them will label it as a virus because they can potentially be "decompression bombs" also known as a "zip bomb" which will overload memory when trying to be unpacked. It may not be true that it is a decompression bomb but Avast says that it hard to detected resulting in some false positives.

share|improve this answer
That's not the (main) reason they get blacklisted. Rather packers are used by amateur malware "developers" to lazily obfuscate their executables. Now, the problem is that this is not a valid reason to blacklist them, because for the most popular packers (UPX, mpack, MEW11SE etc.) all major AV companies do have (realtime)-depackers. ESET has multiple interesting papers on this subject and they are one of the few companies that don't "just" blacklist. Kaspersky on the other hand uses the "evil" packed executables for their (scare the users-) marketing strategy. – mınxomaτ Oct 16 '15 at 22:49

Kaspersky and Nod32 have unpackers for them. Some other are just lazy to do so and insted they lable it as a hack tool. You can try diffrent packers that they don't detect or just rar your exe instead.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.