5

Im trying to pack an Executable using an Exe Packer like UPX.I packed and checked the File with VirusTotal.com.Here some 9 Antivirus Products say its a Virus actually its a harmless exe.I think the AV Engines which are based on Ikarus has problems like this. Why can't they check the file properly using better techniques before flagging it as a virus.

  • 1
    What "better techniques" would you suggest? – bobince Jun 26 '12 at 7:07
1

I believe some of them will label it as a virus because they can potentially be "decompression bombs" also known as a "zip bomb" which will overload memory when trying to be unpacked. It may not be true that it is a decompression bomb but Avast says that it hard to detected resulting in some false positives.

  • That's not the (main) reason they get blacklisted. Rather packers are used by amateur malware "developers" to lazily obfuscate their executables. Now, the problem is that this is not a valid reason to blacklist them, because for the most popular packers (UPX, mpack, MEW11SE etc.) all major AV companies do have (realtime)-depackers. ESET has multiple interesting papers on this subject and they are one of the few companies that don't "just" blacklist. Kaspersky on the other hand uses the "evil" packed executables for their (scare the users-) marketing strategy. – mınxomaτ Oct 16 '15 at 22:49
  • This is incorrect. Decompression bombs are detected when the limit in nesting depth is exceeded when peeking in a nested archive. Packers do not do this. – forest Jun 7 '18 at 3:13
3

Kaspersky and Nod32 have unpackers for them. Some other are just lazy to do so and instead they label it as a hack tool. You can try different packers that they don't detect or just rar your exe instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.