NOD32 and FSG 1.33, 2.0 unpack errors

Hello:

Does NOD32 unpack FSG 1.33 or 2.0? I'm getting "unpack error" with some files that are packed with FSG (maybe all of them).

Thanks in advance.

 

I assume they are patched FSG's, but AH will scan them inspite of these errors.

 

Marcos:

Have no idea if they are patched FSG's. NOD32 doesn't scan them, apparently, but rather emits the "unpack error" message.

Heres a message I picked up on FSG:
------------------------------------
yeah it's a [F]ast mall [G]ood exe packer

try the auhor's homepage..(sorry in polish )

http://www.xtreeme.prv.pl/

This packer was made for Polish Demoscene (CRYOGEN) for packing intros/demos because the main loader has only 197 bytes. Currently it is so popular because most of Anti Vir programs don't recognize packing method.
-------------------------------------

I've been ignoring these files in the past, assuming that it is a NOD32 problem that will resolve itself when the app unpacks the FSG itself and the resulting files that drop out will be scanned by NOD32. Would that be a safe assumption?

TIA

 

FSG files are unpacked perfectly unless they are patched. In such case, the unpacker will report the error but AH will carry on emulating the code anyway.

 

Marcos:

"AH"? what mean?

In any case, is it then safe to ignore the 'unpack error' messages?

TIA

 

Advanced Heuristics

Thanks,

Chris

 

I have got unpack error problem too with two files.

Another AV could test them without problems. When I switched off "Runtime packer" in on-demand scanner, problem disappeared.