4 ms·

Windows 10 warns that burn.exe contains Trojan:Win32/Wacatac.B!ml. I'm sure it's fine but Windows doesn't let it run. The demos that work are stunning and insp

Windows 10 warns that burn.exe contains Trojan:Win32/Wacatac.B!ml. I'm sure it's fine but Windows doesn't let it run. The demos that work are stunning and inspiring.

Narishma 5y ago
Only happens when it's compiled with the included tcc. It works fine with Microsoft's compiler.
- userbinator 5y ago
  About 20 years ago I remember it was semi-common for binaries compiled with anything other than MSVC to be flagged as false positives by other AVs (I suspect if MS had its own AV at the time, it would definitely raise antitrust allegations...) Lots of beginners using GCC (MinGW and the like) complained why their freshly-compiled Hello World executable would disappear without doing anything as soon as they ran it.
skissane 5y ago
Microsoft Defender is really bad at false positives. I think especially the "!ml" ones – I believe that means it is using heuristics rather than a direct signature match. I have my own parental control software I wrote. (Maybe one of these days I will open source it, but not in its current state.) I wanted to use text-to-speech to send audio messages to our son ("Your time is up in five minutes!" kind of thing). Windows has a bunch of different APIs for this – there is an older COM API (which supports IDispatch so you can use it from VBScript etc), a newer .Net API, an even newer WinRT one. I decided, for my purposes, the easiest thing to do was just call the .Net API from PowerShell. So, I embedded a PowerShell script in my executable. All works – except suddenly Microsoft Defender says it is a Trojan. (Forget which one, it was one of those !ml ones, so it could have even been the same one.) Only when it sees the embedded Powershell script in the executable, took it out and it doesn't. I found a trick – I gzipped the PowerShell script, and embedded the gzipped PowerShell script in the executable instead. I included in the executable a zlib decompressor library so it could decompress it at runtime. Suddenly, no more false positive, Defender thinks my executable is fine. I also found it gets upset if a Windows service runs PowerShell as a subprocess with certain command line arguments (passing the PowerShell code to run on the command line)–it will block the PowerShell subprocess from starting. Again, various tricks – such as Base64-ing the code to be run, and having PowerShell decode it and then evaluate it dynamically – and it no longer complains. I suppose other approaches, such as putting the code to run in a temporary file, or passing it to PowerShell over a named pipe, might also do the trick. Makes me think the whole thing is pretty stupid – if I can use these simple tricks to get around their false positives, why can't malware authors use the same tricks to turn true positives into false negatives?
- herbst 5y ago
  I have been using Linux my whole life. Some years ago I tried distributing some of my tools to windows users. The main feedback I got was hate because I appearantly packaged a virus. It worked on my VMs but not on some others. Most tools have been packaged ruby interpreters with attached scripts. Nothing to weird either. I have not tried releasing anything for Windows ever again.
- jimmaswell 5y ago
  I can't speak to every situation, but all computer/video game/whatever time limits did for me was make me resent my parents and do nothing with the remaining time out of spite. I don't think I'd ever do it to my own kids.
  - deleted 5y ago
    [deleted]
  - skissane 5y ago
    Our son is 8. If we let him, he would stay up until 1am using the computer. We've tried other approaches, such as reasoning with him, or positive reinforcement, but this is the only thing that has worked.

Windows 10 warns that burn.exe contains Trojan:Win32/Wacatac.B!ml. I'm sure it's fine but Windows doesn't let it run. The demos that work are stunning and inspiring.

Narishma 5y ago

Only happens when it's compiled with the included tcc. It works fine with Microsoft's compiler.

userbinator 5y ago
About 20 years ago I remember it was semi-common for binaries compiled with anything other than MSVC to be flagged as false positives by other AVs (I suspect if MS had its own AV at the time, it would definitely raise antitrust allegations...) Lots of beginners using GCC (MinGW and the like) complained why their freshly-compiled Hello World executable would disappear without doing anything as soon as they ran it.

skissane 5y ago

Microsoft Defender is really bad at false positives. I think especially the "!ml" ones – I believe that means it is using heuristics rather than a direct signature match. I have my own parental control software I wrote. (Maybe one of these days I will open source it, but not in its current state.) I wanted to use text-to-speech to send audio messages to our son ("Your time is up in five minutes!" kind of thing). Windows has a bunch of different APIs for this – there is an older COM API (which supports IDispatch so you can use it from VBScript etc), a newer .Net API, an even newer WinRT one. I decided, for my purposes, the easiest thing to do was just call the .Net API from PowerShell. So, I embedded a PowerShell script in my executable. All works – except suddenly Microsoft Defender says it is a Trojan. (Forget which one, it was one of those !ml ones, so it could have even been the same one.) Only when it sees the embedded Powershell script in the executable, took it out and it doesn't. I found a trick – I gzipped the PowerShell script, and embedded the gzipped PowerShell script in the executable instead. I included in the executable a zlib decompressor library so it could decompress it at runtime. Suddenly, no more false positive, Defender thinks my executable is fine. I also found it gets upset if a Windows service runs PowerShell as a subprocess with certain command line arguments (passing the PowerShell code to run on the command line)–it will block the PowerShell subprocess from starting. Again, various tricks – such as Base64-ing the code to be run, and having PowerShell decode it and then evaluate it dynamically – and it no longer complains. I suppose other approaches, such as putting the code to run in a temporary file, or passing it to PowerShell over a named pipe, might also do the trick. Makes me think the whole thing is pretty stupid – if I can use these simple tricks to get around their false positives, why can't malware authors use the same tricks to turn true positives into false negatives?

herbst 5y ago
I have been using Linux my whole life. Some years ago I tried distributing some of my tools to windows users. The main feedback I got was hate because I appearantly packaged a virus. It worked on my VMs but not on some others. Most tools have been packaged ruby interpreters with attached scripts. Nothing to weird either. I have not tried releasing anything for Windows ever again.
jimmaswell 5y ago
I can't speak to every situation, but all computer/video game/whatever time limits did for me was make me resent my parents and do nothing with the remaining time out of spite. I don't think I'd ever do it to my own kids.
- deleted 5y ago
  [deleted]
- skissane 5y ago
  Our son is 8. If we let him, he would stay up until 1am using the computer. We've tried other approaches, such as reasoning with him, or positive reinforcement, but this is the only thing that has worked.