.rnc:   clc
.r:     pop     esi edi edx ecx ebx
        ret
.rc:    stc
        ret
    

vid: Avast Antivirus reports that there's virus detected on your site.

regards,
Mac2004

I'm seeing that too; the file is symbols.exe from examples.
Here is the virustotal report with a detection ratio of 23/43

https://www.virustotal.com/file/abb60294641513b3b7330e32fbb57db103fafc299574198a6a8fd03db2f4b28c/analysis/

IntToStr:
   push edi
   mov eax, [esp + 8]    ; value
   mov edi, [esp + 0ch]  ; buffer

   movq xmm0, [Divider]
   pxor xmm6, xmm6
   xor ecx, ecx

   ; check for sign
   cdq
   xor eax, edx
   sub eax, edx
   and edx, '-'
   setnz cl
   cvtsi2sd xmm1, eax
   mov [edi], edx
   add edi, ecx

   ; main loop
@@:mulsd xmm1, xmm0
   cvttsd2si ecx, xmm1
   pslldq xmm6, 1
   add eax, 30h
   lea edx, [ecx + ecx * 4]
   sub eax, edx
   sub eax, edx
   movd xmm2, eax
   xor eax, eax
   por xmm6, xmm2
   add eax, ecx
   jnz @b

   ; save result
   movdqu [edi], xmm6

   ; leave function
@@:pop edi
   ret 8

Divider dq 0.1
    

Windows defender is reporting the library contains a virus and won't allow the dowload, any suggestions?

https://www.virustotal.com/en/file/542528531f124a4dfb1f1270d867ff1cf95053da86167ebeae6d477af3b252cd/analysis/
Why and what to do?

VirusTotal is detecting a legitimate software I have developed, please remove the detections

VirusTotal acts simply as an information aggregator, presenting antivirus results, file characterization tool outputs, URL scanning engine results, etc. VirusTotal is not responsible for false positives generated by any of the resources it uses, false positive issues should be addressed directly with the company or individual behind the product under consideration.

We can, however, help you in combatting false positives. VirusTotal has built an early warning system regarding false positives whereby developers can upload their software to a private store, such software gets scanned on a daily basis with the latest antivirus signatures. Whenever there is a change in the detections of any of your files, you are immediately notified in order to mitigate the false positive as soon as possible.

Actually it is not VirusTotal's fault for the false detections.

If there is a problem then talk to the AV vendor

Or, my preferred option, delete any and all AV's and then use your own judgement about what is a virus and what is not.

revolution wrote:

If there is a problem then talk to the AV vendor

To 30 AV vendors...

And the main problem is that other users will think, that my program is a virus.

However: vid's binaries are from 2007, and fasm has changed a lot in the meantime. If you recompile vid's stuff with a modern fasm, do you then still get a massive number of false positives? If yes, then I guess Tomasz (the author of fasm) may be interested to learn about the fact.

Or hunt down vid (the author of the library), and convince him to remove all binaries from the ZIP file. That's a single point of contact for you => easier to do. It is also a future-proof solution: no precompiled binaries => no false positives any more.

I tried to recompile the DLL file and do a binary compare but I can't figure out how to do it. Has vid posted instructions somewhere on how to make a new DLL? There is no file in the zip file that I could find that has 'format pe dll' so perhaps vid has some Secret Recipe©®™ to generate the DLL?