Antivirus detecting wrongly a fasm produced PE

flat assembler
Message board for the users of flat assembler.

Index > Windows > Antivirus detecting wrongly a fasm produced PE

Author

Thread

pelaillo
Missing in inaction

Joined: 19 Jun 2003
Posts: 878
Location: Colombia

pelaillo 27 Jun 2003, 08:41

This is the message:

"The file attachment info.exe you sent to the recipients listed above was infected with the New Poly Win32 virus and was deleted."

The info from antivirus site is:
Virus Characteristics:
This is a heuristic detection which indicates that a file is possibly infected with a Polymorphic Win32 virus.
Mad

The file is a small single section PE and obviously there is no viruses in it or viral techniques at all.
I wonder if antivirus is detecting only because is only one section.

27 Jun 2003, 08:41

Tomasz Grysztar

Joined: 16 Jun 2003
Posts: 8106
Location: Kraków, Poland

Tomasz Grysztar 27 Jun 2003, 08:52

Yeah, those heuristics are very suspicious.

27 Jun 2003, 08:52

Vortex

Joined: 17 Jun 2003
Posts: 318

Vortex 27 Jun 2003, 10:49

Pelaillo,

The same thing happen with the DLLs from the masm32 package - false
alarm.

What about the latest project on your scripting engine?

_________________
Code it... That's all...

27 Jun 2003, 10:49

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum