Appendix B
103
Packed executables contain a special unpacking program. When such
a file is launched, the main program is first unpacked in the RAM and
then executed.
Infected files can be packed in the same way as uninfected ones.
Regular scans will recognize such infected files as clean, since the virus
body is packed with the program code.
With the executable module Extracting Engine enabled the anti-virus program
will unpack files created with different versions of the most popular packing
utilities, including DIET, PKLITE, LZEXE, EXEPACK etc., into the temporary file
area and then rescan them using the main module. After scanning, the
temporary files are deleted.
Temporary files are stored in a special working directory. You can
manually specify the path to this directory (see section A.2 on page 75).
If a known virus is detected in the packed file, it can be removed (if disinfection is
set as an action to be applied to infected files – see section B.2.2 on page 103).
The initial file will be replaced with its unpacked and disinfected copy. With the
extracting engine disabled, executable modules will be scanned as unpacked
and a virus can only be detected if it has infected the packed file itself.
The extracting engine works correctly with iteratively packed files. In addition, it
works with some versions of file immunizers – the programs that protect
executable files from infecting by adding checksums (CPAV and F-XLOCK), as
well as with some versions of encryption software (CryptCOM).
If both archive and executable file extracting engines are enabled, then
Kaspersky Anti-Virus will detect an infected file even if it is, for example,
encrypted with CryptCOM, then packed with PKLITE and finally archived using
PKZIP.
B.2.2. The
Actions
Tab
On the
Actions
tab (see Figure 61) the user can specify the actions to be taken
by the program to any infected or suspicious files if they are detected, as well as
the actions to be applied to a workstation that attempts to upload an infected
object to the server.
In addition, you can allow/prohibit renaming or deleting of archives during the
scanning procedure. To do so, enable or disable the
Allow deleting or
renaming archives
checkbox.