NOD32 and FSG 1.33, 2.0 unpack errors

Discussion in 'NOD32 version 2 Forum' started by FUBARinSFO, Sep 11, 2007.

Thread Status:
Not open for further replies.
  1. FUBARinSFO

    FUBARinSFO Registered Member

    Joined:
    Sep 11, 2007
    Posts:
    14
    Hello:

    Does NOD32 unpack FSG 1.33 or 2.0? I'm getting "unpack error" with some files that are packed with FSG (maybe all of them).

    Thanks in advance.
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    I assume they are patched FSG's, but AH will scan them inspite of these errors.
     
  3. FUBARinSFO

    FUBARinSFO Registered Member

    Joined:
    Sep 11, 2007
    Posts:
    14
    Marcos:

    Have no idea if they are patched FSG's. NOD32 doesn't scan them, apparently, but rather emits the "unpack error" message.

    Heres a message I picked up on FSG:
    ------------------------------------
    yeah it's a [F]ast mall [G]ood exe packer

    try the auhor's homepage..(sorry in polish )

    http://www.xtreeme.prv.pl/

    This packer was made for Polish Demoscene (CRYOGEN) for packing intros/demos because the main loader has only 197 bytes. Currently it is so popular because most of Anti Vir programs don't recognize packing method.
    -------------------------------------

    I've been ignoring these files in the past, assuming that it is a NOD32 problem that will resolve itself when the app unpacks the FSG itself and the resulting files that drop out will be scanned by NOD32. Would that be a safe assumption?

    TIA
     
  4. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    FSG files are unpacked perfectly unless they are patched. In such case, the unpacker will report the error but AH will carry on emulating the code anyway.
     
  5. FUBARinSFO

    FUBARinSFO Registered Member

    Joined:
    Sep 11, 2007
    Posts:
    14
    Marcos:

    "AH"? what mean?

    In any case, is it then safe to ignore the 'unpack error' messages?

    TIA
     
  6. Chris12923

    Chris12923 Registered Member

    Joined:
    May 31, 2004
    Posts:
    1,097
    Advanced Heuristics

    Thanks,

    Chris
     
  7. Kosak

    Kosak Registered Member

    Joined:
    Jul 25, 2007
    Posts:
    711
    Location:
    Slovakia
    I have got unpack error problem too with two files.

    Another AV could test them without problems. When I switched off "Runtime packer" in on-demand scanner, problem disappeared.
     
    Last edited: Sep 14, 2007
Thread Status:
Not open for further replies.