The difference between packed and archives scanning?

Well, as you know, an archive is a container holding maybe one or maybe hundreds of files, which together are treated as a single file, the container, providing for easy handling and transmission. An archive may or may not be compressed. The most common tool for handling archives on Windows systems is probably WinZIP. Scanning for malware in an archive file involves being able to access all the files within it.

A packed file is different. You hear a lot about "packed executable files", especially when you look at AV/AT products. Executable files can be packed by a vast number of different packers, using different methods and algorithms. Packing is generally done to reduce the physical size of the file. But, packing can also be used in an attempt to mask what's in an executable file from a malware scanner. That's why you see so much talk about different unpackers and the power of unpackers within various AV/AT products. A good unpacker can make a huge difference in how well a scanner detects malware inside a packed file.

The interesting thing about packed executables is that they remain executable in that packed form. They can still be run directly, unlike a file contained in an archive, which must first be extracted in order to gain access to it.

In many of the posts you've made recently, talking about the AV tests you've run on your system, you've mentioned the "number of files" scanned and how some scanners "find" many more files than others. I believe this is because you've got a number of archives on your system and depending upon whether or not the scanner can access archives, and "how deep" it can access into an archive, you see a difference in the total number of files scanned. While this feature is of some importance, it is not the end all in detecting today's malware, but unpacking may be!

If you do have packed executables on your system, some malware within them might not be detected if the scanner you are using does not unpack the specific method they have been packed with. The file itself is still seen by the scanner, most likely, but it doesn't understand what's in it if it doesn't know that format.

Here's one common packer reference site: UPX

Edit: Firefighter - I'd be interesting is hearing how many files get scanned on your system when running the Panda Online AV Scanner (see link to it from our Free Services page). For me, this one scans the most files on my system.

Best Wishes,
LowWaterMark

 

Thanks Firefighter! I was interested in seeing just how many files the Panda online scanner could access compared to the other products you've been testing. It's not too bad for just an online scanner.