Hello,
All examples in FASM directory or all my programs compiled with FASM are detected by 2 Antivirus
Why ?


http://www.virustotal.com/analisis/6d980ee978e54b189ce3ad49f1b60e87

Anyone have a exemple of source undetected !?
Thanks

This very common. I think there are a few viruses out there that were (at least partially) written in fasm.

It is unfortunate, but difficult to do anything about.

No more giving back...

Hey kohlrak, heuristics doesn't always mean sigs. Maybe it just doesn't like something that FASM does and a compiler doesn't, possibly something in the header.

False positives are an inconvenience. But false negatives are a show stopper, so AV companies have to play it safe.

Even if, as a community, we manage to make some sort of standard format that is not detected as a virus, guess what, the virus writers will also use that new format. So the cycle repeats, the AV companies add a new signature and were back where we started.

Good point, but virii are detected a lot of times by errors they create in the PE header, like forgetting to update a previously-valid checksum or having a section size wrong. If I remember correctly, I had disasmed a FASM created header to find that a section header had a larger physical size than virtual size! Could this be the invalidity that's being seen?

First, you would have to start doing things "normal way". By that i mean layout of sections (code first), standard imports, jump for every imported function, etc. etc

After that, we can start looking for problem in FASM itself

No more giving back...

That's the price of heuristic. If only viruses and FASM apps use something easily detectable, will they think twice? (in case they know about FASM, btw)

No more giving back...

Well, it could be a rootkit, it doesn't say good or bad

> All examples in FASM directory or all my programs compiled with FASM are detected

Already pointed 1'000'000'000 times:

http://board.flatassembler.net/topic.php?t=7302
http://board.flatassembler.net/topic.php?t=7310
http://board.flatassembler.net/topic.php?t=7807
http://board.flatassembler.net/topic.php?t=8154
http://board.flatassembler.net/topic.php?t=8818 (this one)

> Anyone have a exemple of source undetected !?

NO. Feel free to consider it as FASM's fault or fault of your "Antivirus" virus ... and throw away 1 of them then ...

vid wrote:

> First, you would have to start doing things "normal way".



> By that i mean layout of sections (code first), standard imports,
> jump for every imported function, etc. etc
> After that, we can start looking for problem in FASM itself

"better" way: delete PE support from FASM, just use M$-linker instead
Even "better": drop FASM / ASM and switch to Visual Baysic

I have never used anti-virus software. The body is a good example of how to fight virii - common antigens are literally hunted for by the immune system. Trying to partially mimic this process in software might work at a larger scale, but the analogy fails at the individual computer level because multiple copies of software don't typically exist/operate on a single PC and software isn't typically designed to work in that fashion.

The human body doesn't care about false positives for the most part. Cells can be neutralized and everything continues working just fine. On a PC it is a completely different story - warnings can take considerable forensic work before knowing how to respond. Not just if it is a virus, but also how it's removal could impact the system. Anti-virus software fails on both counts, and merely provides psychological comfort. The resources are just not worth it when backups and virtual environments are so easy to setup.

Save your time and money by planning for system failure.

Stop using substandard AV software. PROBLEM SOLVED

Q: What do you do when the AV software you're running is BROKEN???
A: You uninstall it and find an alternative.

If you really want to be nice send an email to the AV software's support address and tell them their software is broken.

No more giving back...

AFAIK, heuristics burrows deeper. At least, in AI.

kohlrak, whats up with "No more giving back..." posted 3 times in this thread by you, and in your signature.......?

edit: i also notice that all those posts have been edited once. Maybe they used to say something else?... lol i think too much

edit 2: (about 20 seconds after first edit!)
sorry old-ish topic, but still... "No more giving back..."?

And "All your base are belonged to us".
Please stop this "heuristics on FASM"-spam and should there be a sticky with detectable name so new users would stop creating new topics !? :S

Which one should get sticky? Or start a new thread?

I didn't even measure this scenario through. Yeah, maybe start a new one explaining the strange behavior and link all stray topics to this. I don't know what's the sanest thing to do.