i quess it's unstandard layout of PE sections... this really doesn't appear in any real file.

format PE GUI 4.0
include 'win32a.inc'
entry main
section '.text' code readable executable
main:
    invoke MessageBox,0,msg,ttl,0
    ret

section '.data' data readable writeable
msg db 'hello world',0
ttl db 'simple program',0

section '.idata' import data readable
library user32,'user32.dll'
import user32,MessageBox,'MessageBoxA'     

Would anyone be interested in creating a AV program in FASM?
It would be simple, light-weight and fast.

I haven't run one in DOS yet, but I do know that it doesn't contain any kind of message (or code to dispaly the message).

C:\DOCUME~1\Hernan\ESCRIT~1>debug test2.exe
-g
This program cannot be run in DOS mode.

El programa ha terminado de forma normal    

make_stub:
        mov     [stub_file],edx
        or      edx,edx
        jnz     stub_from_file
        push    esi
        mov     edx,edi
        xor     eax,eax
        mov     ecx,20h
        rep     stos dword [edi]
        mov     eax,40h+default_stub_end-default_stub
        mov     cx,100h+default_stub_end-default_stub
        mov     word [edx],'MZ'
        mov     word [edx+4],1
        mov     word [edx+2],ax
        mov     word [edx+8],4
        mov     word [edx+0Ah],10h
        mov     word [edx+0Ch],0FFFFh
        mov     word [edx+10h],cx
        mov     word [edx+3Ch],ax
        mov     word [edx+18h],40h
        lea     edi,[edx+40h]
        mov     esi,default_stub
        mov     ecx,default_stub_end-default_stub
        rep     movs byte [edi],[esi]
        pop     esi
        jmp     stub_ok
      default_stub:
        use16
        push    cs
        pop     ds
        mov     dx,stub_message-default_stub
        mov     ah,9
        int     21h
        mov     ax,4C01h
        int     21h
      stub_message db 'This program cannot be run in DOS mode.',0Dh,0Ah,24h
        rq      1
      default_stub_end:
        use32    

It's not the PE headers or the sections that are the problem. Some antivirus programs also check for older, DOS viruses inside .EXE files. The Windows PE executable format uses a so-called stub DOS program which displays a message if the program is ran in DOS, but the .EXE files created by FASM use a non standard stub program, with most of the MZ (DOS executable header) fields overwritten to make the resulting EXE's smaller. I haven't run one in DOS yet, but I do know that it doesn't contain any kind of message (or code to dispaly the message).

Also, another problem may be that you used a "ret" to exit the program, instead of calling ExitProcess....

format PE GUI 4.0
include 'win32a.inc' 
entry main 
section '.text' code readable executable 
main: 
    invoke MessageBox,0,msg,ttl,0 
    invoke ExitProcess,0

section '.data' data readable writeable 
msg db 'hello world',0 
ttl db 'simple program',0 

section '.idata' import data readable 
library user32,'user32.dll',\
        kernel32,'kernel32.dll'
import user32,MessageBox,'MessageBoxA'
import kernel32,ExitProcess,'ExitProcess'     

But why would the ret be so harmfull?

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00117077.



A listing of files alongside their results can be found below:

File ID Filename Size (Byte) Result
3651385 test.exe 1.5 KB FALSE POSITIVE


Please find a detailed report concerning each individual sample below:

Filename Result
test.exe FALSE POSITIVE

The file 'test.exe' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection will be removed from our virus definition file (VDF) with one of the next updates.

call dword [MessageBox]
    

call MessageBox
...
MessageBox: jmp dword [__imp_MessageBox]
    

...I don't know what's worse, if it doesn't detect the virus or if it detects a program that's not virus as virus.

format PE GUI 4.0
include 'win32a.inc'

section '.code' code readable executable

            invoke ExitProcess,0

section '.data' code readable writeable

data import

 library kernel32,'KERNEL32.DLL'

 import kernel32,ExitProcess,'ExitProcess'

end data    

section '.data' readable writeable    

section '.code' readable executable
...
section '.data' readable writeable
...    

db 4096 dup ('x')    

entry $    

format PE GUI 4.0
entry start    

the only thing keeping me from writing a virus with perfect metamorphasis which installed a secure OS on infected PCs; is that I would probably spend the rest of my short natural life in an american prison in Syria.