Im trying to pack an Executable using an Exe Packer like UPX.I packed and checked the File with VirusTotal.com.Here some 9 Antivirus Products say its a Virus actually its a harmless exe.I think the AV Engines which are based on Ikarus has problems like this. Why can't they check the file properly using better techniques before flagging it as a virus.

  • 1
    What "better techniques" would you suggest?
    – bobince
    Jun 26, 2012 at 7:07

2 Answers 2


I believe some of them will label it as a virus because they can potentially be "decompression bombs" also known as a "zip bomb" which will overload memory when trying to be unpacked. It may not be true that it is a decompression bomb but Avast says that it hard to detected resulting in some false positives.

  • That's not the (main) reason they get blacklisted. Rather packers are used by amateur malware "developers" to lazily obfuscate their executables. Now, the problem is that this is not a valid reason to blacklist them, because for the most popular packers (UPX, mpack, MEW11SE etc.) all major AV companies do have (realtime)-depackers. ESET has multiple interesting papers on this subject and they are one of the few companies that don't "just" blacklist. Kaspersky on the other hand uses the "evil" packed executables for their (scare the users-) marketing strategy.
    – mınxomaτ
    Oct 16, 2015 at 22:49
  • This is incorrect. Decompression bombs are detected when the limit in nesting depth is exceeded when peeking in a nested archive. Packers do not do this.
    – forest
    Jun 7, 2018 at 3:13

Kaspersky and Nod32 have unpackers for them. Some other are just lazy to do so and instead they label it as a hack tool. You can try different packers that they don't detect or just rar your exe instead.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .