Avira still picking up fals positives

[ecube]

load dlls dynamically and then call the functions. Vortex has a _invoke macro on here somwhere that lets you use the address like you would with invoke(doesn't work with cdecl calls only stdcall). This should make av's crappy heur stop whining. If you use GoASM it can invoke the dynamic function call directly which is neat.

[ThexDarksider]

Seems they've improved it, no false positives here. I've compiled a few viruses on VirtualBox and it found them, but didn't flag non-viral code. :bg

[hutch--]

 :tdown

Darksider,

We shoot anyone who messes around with viruses here. Tread carefully or you will get arseh*led out the door faster than Haley's comet.

[ThexDarksider]

:tdown

Darksider,

We shoot anyone who messes around with viruses here. Tread carefully or you will get arseh*led out the door faster than Haley's comet.

Affirmative.

[spikegee]

I am new to MASM32, and the current update (as of 25 July 2010) of Avira Antivir detects finst.exe, a temporary executable created during installation,
as containing the Trojan horse TR/Gendal.3938680.

I think this is due to signature rather than heuristics, as I have set the heuristic feature to its lowest level.

It feels not very safe to install the MASM32 SDK with those AV warnings,
though I admit it seems unlikely that a widely used development software as this one would be bundled with viruses.

For now I installed it on a sandboxed environment,
does anyone have some hints towards the safety of this install?

[Gunner]

If you gotten the MASM package from Hutchs' site, then there are NO virii in any of the files no matter what any AV says... its just the way the asm progs are written...

[hutch--]

Spike,

Do yourself a favour and shoot it, its not one of the high quality AV products. This stuff is build in an isolated environment and has been tested on millions of computers. The fault is in the crappy AV scanner you are using. Their problem is they don't properly understand the Microsoft Portable Executable specifications and try and inflict a subset based on their limited heuristc detection skills.