The testing of antivirus solutions for their support of packer utilities is performed by Anti-Malware.ru experts on a regular basis. We closely track new versions of various packers appearing on the Internet and analyze the popularity of their different versions and modifications.

Moreover, the Anti-Malware.ru project has close ties with several antivirus companies, which provide information on the use of different packers by virus writers.
The list of packers is prepared based on the information received. One week prior to testing, the versions of packers to be used in the testing are selected. This information is available to antivirus vendors.

During the same period, 5 to 10 virus samples are selected. The selection should represent different types of malicious code (viruses, worms, Trojans, spyware, keyloggers, etc.). The main requirements for sample selection is that they should not be packed and should be successfully detected in this form by all antivirus products to be tested. Information about the selected samples of malicious code to be used during testing is not provided to antivirus developers until after testing is completed.

Testing steps:

1. The virus samples selected are packed using the packers selected. The result is X modifications of each virus, where X is the number of packers used in the test.
2. Then, each copy is verified, i.e., checked to ensure that it correctly perform all of its functions after packing.
3. The test per se is conducted, i.e., the latest versions of antivirus products with up-to-date databases are tested for detection of the packed viruses.

Steps 1 and 2 are performed during the week preceding testing, but, after the packer versions have been officially selected. If a virus fails to perform its functions after being compressed with a packer, this virus modification is excluded from testing.

As stated above, testing is conducted on the latest versions of antivirus software with the latest updates installed.

The frequency of testing is determined by the Anti-Malware.ru project team depending on the appearance of new packer versions, changes in the popularity of individual packers and analysis of data provided by different vendors. Testing is conducted at least four times a year.

Packers detected by all antivirus products tested are not included in the subsequent round of analysis, unless their versions (algorithms, methods used, etc.) change.