4 ms·

FYI I downloaded the Fermi Paradox intro from that website (the actual executable one), and Windows Defender quarantined it, claiming it contains a Win32/Tiggre

by sbarre 9y ago

FYI I downloaded the Fermi Paradox intro from that website (the actual executable one), and Windows Defender quarantined it, claiming it contains a Win32/Tiggre!rfn trojan. I don't know enough about this stuff to figure out if it's a false positive, but there you go.

yunyu 9y ago
Some of the strategies that demoscene authors use to shrink their executable size (think packing, self-modifying code, etc...) are also incredibly common in malware.
laurentlb 9y ago
Some antivirus complain about any file compressed using kkrunchy (http://www.farbrausch.de/~fg/kkrunchy/ http://www.farbrausch.de/~fg/kkrunchy/). This is a known issue. Some background here: https://conspiracy.hu/about/antivirus/ https://conspiracy.hu/about/antivirus/ The only solution is to report the false positive to antivirus vendors, but it takes a lot of time.
- sbarre 9y ago
  Thank you for the explanation.
- userbinator 9y ago
  Alternatively, stop using antivirus. The amount of stuff that gets flagged as false positives is incredible once you go outside of the applications written by big corporations and the like. It's almost as if they use a whitelist... Also, seeing that some AV will alert on even the presence of an empty folder that happens to share the same name as actual malware[1] or a completely innocuous Hello World[2][3], it's hard to recommend any. That and the detection of cracks and keygens (which goes beyond "antimalware", IMHO) further strengthens my opposition against what is essentially censorware. [1] https://news.ycombinator.com/item?id=2390907 https://news.ycombinator.com/item?id=2390907 [2] https://www.csoonline.com/article/3216765/security/heres-why-the-scanners-on-virustotal-flagged-hello-world-as-harmful.html https://www.csoonline.com/article/3216765/security/heres-why... [3] https://stackoverflow.com/questions/22926360/malwarebytes-gives-trojan-warning-for-basic-c-sharp-hello-world-program https://stackoverflow.com/questions/22926360/malwarebytes-gi...

by sbarre 9y ago

yunyu 9y ago

Some of the strategies that demoscene authors use to shrink their executable size (think packing, self-modifying code, etc...) are also incredibly common in malware.

laurentlb 9y ago

Some antivirus complain about any file compressed using kkrunchy (http://www.farbrausch.de/~fg/kkrunchy/ http://www.farbrausch.de/~fg/kkrunchy/). This is a known issue. Some background here: https://conspiracy.hu/about/antivirus/ https://conspiracy.hu/about/antivirus/ The only solution is to report the false positive to antivirus vendors, but it takes a lot of time.

sbarre 9y ago
Thank you for the explanation.
userbinator 9y ago
Alternatively, stop using antivirus. The amount of stuff that gets flagged as false positives is incredible once you go outside of the applications written by big corporations and the like. It's almost as if they use a whitelist... Also, seeing that some AV will alert on even the presence of an empty folder that happens to share the same name as actual malware[1] or a completely innocuous Hello World[2][3], it's hard to recommend any. That and the detection of cracks and keygens (which goes beyond "antimalware", IMHO) further strengthens my opposition against what is essentially censorware. [1] https://news.ycombinator.com/item?id=2390907 https://news.ycombinator.com/item?id=2390907 [2] https://www.csoonline.com/article/3216765/security/heres-why-the-scanners-on-virustotal-flagged-hello-world-as-harmful.html https://www.csoonline.com/article/3216765/security/heres-why... [3] https://stackoverflow.com/questions/22926360/malwarebytes-gives-trojan-warning-for-basic-c-sharp-hello-world-program https://stackoverflow.com/questions/22926360/malwarebytes-gi...