[color=black][/color]
Hi,

Pardon me if this is already known. I noticed that the executable dialog.exe has different internals from a fresh compile of dialog.asm in the examples folder. If I run the original executable dialog, I don't get a virus warning and everything's fine. If I run the newly compiled file from dialog.asm, my antivirus software (Symantec) kicks in and quarantines the exe file. The risk shown ia SONAR.Heuristic.121.

I did an FC (filecompare) command between the newly generated file and the EXE provided and this is what I get.

Comparing files DIALOG.EXE and DIALOGBACKUP.EXE (the exe that comes with the install zip file is renamed to dialogbackup.exe). Seems that a few critical bytes are different:

00000088: 00 39
00000089: 3B EC
0000008A: DF 27
000000D8: F5 FC
000000D9: F1 B3
00000804: 00 39
00000805: 3B EC
00000806: DF 27
0000081C: 00 39
0000081D: 3B EC
0000081E: DF 27
00000834: 00 39
00000835: 3B EC
00000836: DF 27

Am I supposed to compile the dialog example with some flags? If not, why does fasm.exe give an EXE file with different internals?

Thanks in advance for your guidance. Fasm.exe is a great program.

All of those differences are timestamp and checksum fields set to the time the .exe was compiled. So ignoring those there are no differences.

And to answer your question: Yes it is a bug ... with your AV. Time you delete your AV.

hi, is that possible to turn off any kind of "private" information inside assembled exe?
eg. time? and maybe others identifiable information.

Sure it is. There are two ways. 1) find all instances of %t in your sources and replace them with something else. 2) edit the fasm source for make_timestamp (in system.inc) to create a fixed value.

Thanks revolution for the quick advice... hmm.. looks like I should inform the AV company about this silly problem so that they can fix it. Imagine AV tools triggering off false positives for executables built using fasm...

Thanks again.

newbie1,

Heuristics all the way. They are responsible for the most false positive nowadays.