Is AV scanning zip files with non-exe contains re-assuring/reliable?

Question

I was wondering how safe is scanning a .zip file and depending on the AV report on what to do with it. So specifically: If I have a .zip file and I run a scan using a good antivirus and does not report a threat, is that re-assuring? If I know that the .zip file contains only non-exe files e.g. mp3 and mp4 and I extract the .zip and then scan each file individually and the antivirus does not report a threat is that reassuring? Is there anything to take into account in this cases?

Answer 1

ZIP doesn't change much. A competent AV program should report the same results for zipped and unzipped files.

Non-executable files will generally be less likely to contain malicious code because launching that code is much more difficult. With programs, scripts etc. you are executing some code by running that executable. In non-executable formats the attacker doesn't have this convenience and must find a way to trick the program reading the file (the player, document viewer etc.) into executing its contents instead of interpreting it. They have to find a bug in the program and a reliable way to exploit it. But different programs may use different file loading code, so the malicious file must be prepared with specific software in mind. This makes this kind of attack less practical.

That doesn't mean that non-executable formats are to be trusted. Such exploits in popular software are found every now and then. Some files also have non-obvious executable parts, eg. Word and Excel documents can contain executable macros. The fact that Word is so commonplace on Windows PCs and its files look benign makes it a very attractive vector.

It also doesn't mean that less popular, obscure programs are safer. They can use the same file parsing library as more popular software, along with its bugs, but will probably be updated less frequently with fixes and not battle-tested as thoroughly.

The bottom line is: don't open files from untrusted sources and make sure your automated backups are complete, up to date and restorable.

Answer 2

After a scan by an antivirus of zipped or unzipped files, you can be sure that it doesn't contain any virus that is known to the antivirus program.

In other words, such a scan makes it a bit safer, but absolutely you are not safe, as antivirus programs are never perfect.

To be still safer, you could upload the file to virustotal, where it will be scanned by dozens of antivirus products. If all of them find nothing, you may safely decide that it's safe.

For still much more safety, install sandboxie and examine or execute the file from within a sandbox. You're then extremely well isolated from the real Windows, operating then only inside a virtual environment that you can wipe out with a click.

Answer 3

I have decided to run practical test using EICAR test file. The version I used is padded to length 128 by spaces, otherwise the original text still stayed unmodified in the file when viewed in hex editor.

I have uploaded uncompressed and compressed version to virus total. In both cases most antiviruses detected a malware, but the detection rate have dropped from 57/66 to 49/63.

Following antiviruses failed to detect "malware" (ignoring those which were unable to process file or failed to detect even uncompressed file):

• Ad-Aware
• Alibaba¹
• ALYac
• SUPERAntiSpyware
• Symantec¹
• TACHYON

Unless your antivirus is in this list, then it is most likely that scanning compressed files is equal to scanning uncompressed files. But keep in mind that antiviruses will be unable to scan password protected archives, but there seems to be two exceptions to this. Antiviruses Cyren and Fortinet seem to be able to scan archives with ZipCrypto encryption and arbitrary password. All antiviruses are unable to scan archives with AES-256 encryption and even simple password (tested with 123456).

---

¹ Those antiviruses were able to detect "malware" only after rescanning the file and also they weren't able to detect different archive with same content. This probably means they learned about the detections from other antiviruses and chose to report the file as virus too.