D E F I N I N G S E T T I N G S
41
41
41
41
5.3.2.4. Packed
executables
Scanner can check for viruses in packed executable files that are unpacked
by the special engine.
Packed executable files contain special unpacking modules. When such a
file is started, the module unpacks the program to RAM and then runs it.
Packing utilities can pack infected files along with clean ones. If these are
scanned by a conventional anti-virus scanner, the infected file would be
passed as virus-free, because the virus body was packed together with the
program code.
$"
To enable the unpacking engine,
type
Yes
in the
Packed
line of the profile. After this, your Scanner will be
able to check and delete viruses from packed executable files.
!"
This parameter corresponds to the command line switch
-U[-]
. The
switch
-U
disables and the switch
-U-
enables the unpacking engine.
The unpacking engine unpacks files that have been packed by various
versions of the most popular utilities: DIET, PKLITE, LZEXE, EXEPACK
etc., to temporary files so the anti-virus scanner can check them. When the
check is completed the temporary files are deleted.
!"
The unpacking engine generates temporary files in the directory
defined by the
TempPath
parameter in the
[TempFiles]
section of a
profile (see subchapter 5.4.2).
If a virus known to
Kaspersky Anti-Virus for xBSD File Server
was
detected in some packed file, it can be deleted (if your Scanner was preset
to disinfect files — see subchapter 5.3.3). In this case the infected file will
be replaced by the unpacked and disinfected one. If the unpacking engine
is disabled, packed executable modules will be scanned as unpacked and
your Scanner will only be able to detect viruses that infected the files when
they were already packed.
The unpacking device is able to correctly unpack files that have been
compressed multiple times. It can also deal with some versions of
immunizers, programs protecting executable files from viruses by attaching
checking code blocks (like CPAV and F-XLOCK) and enciphering
programs (like CryptCOM) to them.
