Author Topic: False Positive or Not ?  (Read 6970 times)

0 Members and 3 Guests are viewing this topic.

Aurel

  • Guest
False Positive or Not ?
« on: February 02, 2014, 09:28:44 AM »
Hi Charles...& others

One thing makes me crazy...
I clean one my hdd with GParted and install fresh copy of windows
then i download last InProgres version of OxygenBasic.
and create one of my programs...build standalone exe.
then i check this exe with VirusTotal and again...
10/48 ...what a heck?
Then i download last version of FreeBasic and build exe then check again with Virustotal.
and NOTHING !  :o

How is this possible?
Why all this AV-s jump on OxygenBasic created exe file?
This is not good at all...

Quote
Ad-Aware      Gen:Variant.Kazy.288120      20140202
AntiVir    TR/Crypt.XPACK.Gen2    20140202
BitDefender    Gen:Variant.Kazy.288120    20140202
ESET-NOD32    a variant of Win32/Kryptik.BEU    20140202
Emsisoft    Gen:Variant.Kazy.288120 (B)    20140202
GData    Gen:Variant.Kazy.288120    20140202
MicroWorld-eScan    Gen:Variant.Kazy.288120    20140202
NANO-Antivirus    Trojan.Win32.XPACK.csvfbg    20140202
Rising    PE:Malware.XPACK/RDM!5.1    20140202
VIPRE    VirTool.Win32.Obfuscator.da!j (v)
 

Aurel

  • Guest
Re: False Positive or Not ?
« Reply #1 on: February 02, 2014, 11:00:57 AM »
This simple program :

Code: [Select]
'test print
$ filename "hello.exe"
include "rtl32.inc"
print "Hello!"

create 4 alerts:

Quote
AntiVir      TR/Crypt.XPACK.Gen2      20140202
Bkav    HW32.Laneul.zqim    20140125
ESET-NOD32    a variant of Win32/Kryptik.AMH    20140202
Rising    PE:Malware.XPACK/RDM!5.1    20140202

« Last Edit: February 02, 2014, 11:11:52 AM by Aurel »

Aurel

  • Guest
Re: False Positive or Not ?
« Reply #2 on: February 02, 2014, 11:10:36 AM »
And this one create 3 alerts:

Code: [Select]
'test print
$ filename "hello2.exe"
Declare Function MessageBox Lib "user32.dll" Alias "MessageBoxA" (ByVal hwnd As Long, ByVal lpText As String, ByVal lpCaption As String, ByVal wType As Long) As Long
MessageBox 0,"Hello!","Message Box",64

Quote
AntiVir      TR/Crypt.XPACK.Gen2      20140202
CMC    Trojan.Win32.Krap.1!O    20140122
Rising    PE:Malware.XPACK/RDM!5.1

Kuron

  • Guest
Re: False Positive or Not ?
« Reply #3 on: February 02, 2014, 02:14:14 PM »
AV programs flagging anything written by you is a good thing. ;)

Aurel

  • Guest
Re: False Positive or Not ?
« Reply #4 on: February 02, 2014, 02:44:27 PM »
really ?
As i say ...why for example program compiled by Free Basic is clean
and is written by me and with my include file( .bi)
and also
why program written in CodeBlocks and compiled with MingW is clean
and only programs created by oxygen generate alerts ..ha ?

Anyone is free to test ...right?

Kuron

  • Guest
Re: False Positive or Not ?
« Reply #5 on: February 02, 2014, 03:36:18 PM »
Comparing the results of different languages is irrelevant, unless the exact same code is being compiled, using the exact same APIs and the EXE is being put together in the exact same way by the programming language.

One API call made wrong can flag AV programs.  Some API calls done correctly will flag AV programs because it is an API rarely used by legitimate programs.  An EXE put together in an abnormal order will flag an AV program.  For example, Bob Zale made a change in one of the last versions of PB that started flagging AV programs.  After two pages of arguments, he finally conceded he had mistakenly left something in that was resulting in an improper EXE that was flagging the AV programs.  I have no idea if that bug was fixed and a patch issued before he died.  For another example, using PB's Windows API includes which were written by Tom Hanlin will often flag AV programs, because many of the APIs are being called incorrectly.  Use Jose's includes and the problem is solved, because Jose's includes are usually correct in the way they are calling the APIs.


And no, not anyone is free to test.  Under the TOS and License of Virus Total, you can only upload software which you personally own the copyright on.  Once uploading your test EXE there, you give Virus Total "royalty free, irrevocable and transferable licence to use, edit, host, store, reproduce, modify, create derivative works, communicate, publish, publicly perform, publicly display and distribute such content."

Most people would not give away all rights to their software in this manner.  What is worse is when people will download an application or game you have written and upload it to Virus Total in direct violation of your copyright and in blatant violation of the TOS of Virus Total.  This results in several hundred dollars in legal fees for you to get a pull down request issued under the DMCA to Virus Total which is in another country.

JRS

  • Guest
Re: False Positive or Not ?
« Reply #6 on: February 02, 2014, 05:03:57 PM »
Quote
AV programs flagging anything written by you is a good thing.

Too funny!

I don't miss the virus aspect of Windows one bit.


Kuron

  • Guest
Re: False Positive or Not ?
« Reply #7 on: February 02, 2014, 06:10:11 PM »
Too funny!
But, the truth.  Aurel's "virus" issues are well known.  Most know to never download any EXEs or other infectable files he posts.  He also doesn't seem to understand that a virus does not target an EXE immediately when the EXE is created. ::)  There are reasons years back that Paul blocked him from posting attachments, before finally banning him.  


I don't miss the virus aspect of Windows one bit.
What he has is serious and quick replicating and integrated deep enough that only a reformat and reinstall can fully guarantee a clean system.  You truly should watch who you piss off, as it seems you have pissed somebody off pretty bad. ;D  Right now, there is the potential somebody has hidden access and control over your system.  Karma is a bitch.  
« Last Edit: February 02, 2014, 07:08:17 PM by Kuron »

JRS

  • Guest
Re: False Positive or Not ?
« Reply #8 on: February 02, 2014, 09:10:33 PM »
Quote
Karma is a bitch.

And a cowardly way to punish people you don't know rather than coming up with something reasonable to say. Jose Roca figured that out after he ban me and removed the Karma feature from his forum. Amazing how everyone came out of the closet after that. You took on the roll of a whipping boy as well if I remember correctly. I have no idea why Patrice continues wasting his time with PB when he has already migrated to C++ 32/64 bit.




Aurel

  • Guest
Re: False Positive or Not ?
« Reply #9 on: February 02, 2014, 11:25:38 PM »
Quote
here are reasons years back that Paul blocked him from posting attachments, before finally banning him.
 
what a heck is this ...
And why you lie here about things that never heapend...
please put the pipe down and don't respond on my post...toeMan   :D :D :D :D
Hmm it looks to me that you are here to spreading lies...
so my advice to you will be don't mess up with me freak... >:(
« Last Edit: February 02, 2014, 11:40:04 PM by Aurel »

JRS

  • Guest
Re: False Positive or Not ?
« Reply #10 on: February 02, 2014, 11:54:56 PM »
I see another month is in order.

Please refrain from feeding the animals.


Kuron

  • Guest
Re: False Positive or Not ?
« Reply #11 on: February 03, 2014, 12:01:12 AM »
You took on the roll of a whipping boy as well if I remember correctly.
I made several enemies when I stood up to Bob's bullying years ago. 

JRS

  • Guest
Re: False Positive or Not ?
« Reply #12 on: February 03, 2014, 12:06:38 AM »
The best thing Zale ever said to me was I cost him a lot of money. Made my day.


Kuron

  • Guest
Re: False Positive or Not ?
« Reply #13 on: February 03, 2014, 12:15:02 AM »
 
what a heck is this ...
And why you lie here about things that never heapend...
You were banned permanently from the MB forums at my request.


so my advice to you will be don't mess up with me freak... >:(
I do not think you are in a position to give advice to anybody, let alone make threats.

Kuron

  • Guest
Re: False Positive or Not ?
« Reply #14 on: February 03, 2014, 12:20:59 AM »
The best thing Zale ever said to me was I cost him a lot of money. Made my day.
He threatened to sue me.  I begged him to.  Nothing would have made me happier to have him under oath in depositions for a couple of weeks, along with him spending some time behind bars when he perjured himself.