1

I've tried SimplePack, which is an open-source file packer for windows, now, for some reasons, when I check via online virus-checkers, lots of alerts are being popped saying the file is crypted using SimplePack, though the file is innocent.

I realize this is somehow related to a header SimplePack adds or to its algorithm, but I'm not quite sure what to do to fight that, because I'd like to use this for myself.

Suggestions are always welcome! Thanks.

|improve this question
  • If your benign program is being detected by AV engines, you should notify the AV vendors to fix their detections instead of trying to subvert their detection logic. – Jason Geffner Dec 28 '14 at 17:58
  • 1
    Many AV products flag any program that uses a packer as 'suspicious'. In some cases it is possible to hide the fact that a packer is being used, by modifying the packer slightly. However, such success is bound to be short-lived as AV heuristics improve and incorporate more time-consuming detection methods. There are only two ways to escape the AV-numbskullity in the long term: don't use a packer, or stay ahead of the pack. Trying to get all AV vendors to avoid misdetection of a program seems an exercise in futility, even though it is the only way of getting them to change their behaviour. – DarthGizka Dec 28 '14 at 19:18
  • It should also be noted that online virus-checkers (ex. VirusTotal) are often using AV engines which are inherently set to a more high risk level than the normal desktop equivalents. While it is true many AVs will broadly detect packers, VT might be giving you a false sense of real life detections as well. – diff Dec 29 '14 at 5:32
  • the act of patching the packer makes it more likely that your program will be detected as malicious, since that is a common practice among malware authors. Instead, you choose a packer that carries a Taggant. It is highly unlikely to be misdetected. – peter ferrie Dec 31 '14 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.