Signature of packed files

[r3l4x]

Hello
I wonder how removal tools (like Symantec fixes for worms) work to detect packed viruses (UPX, ASPack, PECompact etc....).
An antivirus can unpack files with unpackers so an antivirus researcher can analyze the real code and find a signature.
But a removal tool I believe can't upack files, so the virus signature isn't the same because it scan packed file and not unpacked file.
So how detect a "strong" signature for packed infected files without unpack them? (like F-Prot do)

Regards