and this is why some (defunct imo) AV products have flagged executable packers for as long as i can remember. I have used a modified (header only) version of UPX for some products over the years, and time and time again, some AV will flag it as some generic virus. The reason I used it was to make it a little harder for script kiddies to clone the product, as just changing the UPX header would be enough to disable the generic unpacker scripts. It's gotten even worse in recent years, where a simple (un-obfuscated!) C# .net assembly that simply imports ReadProcessMemory from kernel32 gets flagged as a virus by the same "AV" products. I'm sick of AV products ignorantly flagging shit as malicious, resulting a a lot of extra support, while security-ignorant government mandated (very-well-obfuscated) backdoo... er i mean "bugs" are rampant.