I have had *.exe archives flagged as trojans that when I extracted the files contained and scanned them, the files were not flagged. I have the depth of recursion set to 0 (i.e., infinity). The total size of the files and the size of the *.exe files were always very close so if something was hiding in the exe that wasn't extractable it couldn't be very big. And the extraction program didn't report any irregularities. I've scanned the same archives and extracted files with clamscan and avast as well and they don't see anything problematic. Are these types of events likely false positives?
Is the quantative aspect of my reasoning sound or is iit possible for a *.exe to have some innocent files archived in it and ALSO some short but still nasty code?
I'm assuming that if Bitdefender was just unable to extract an archive and flagged it on the general principle that archives it can't extract might be hiding something nasty it would give an error message saying so but whenever I've seen this I think it was always flagged as a trojan.
I'm tempted to check out files like that in a virtual machine. If anyone knows of a good article on using a vm safely to test suspected programs I would be interested.
