Menu

Detection as a virus

2015-03-09
2015-03-21
  • laikvirshel

    laikvirshel - 2015-03-09

    I'm using Avira Antivirus.
    It was detecting foxspeed 0.15 as a virus type TR/ATRAPS.
    So I submitted it to Avira as possible false Positive.
    Here's their verdict....that it's a malware.
    https://analysis.avira.com/en/status?uniqueid=dsSXOVIvYhnsyKKD1knmSCPrxMG19WDZ&incidentid=1835747

    Do you know why?

    °.....°

     
    • Jose Antonio Diaz Jimenez

      Thanks for pointing this out.
      I'm aware of this issue with Avira, and I'm working on a fix for it.

      this might happen because FoxSpeed modifies some registry settings at HKLM TCP/IP
      Avira looks for executables that may access that registry zones and labels them as virus because most of virus tend to do so.
      In this case it is a false positive, the most recent Avira version Heuristics is having a lot of false positives.

      If you still want to use it, disable Avira while downloading and using Foxspeed.

      If Foxspeed where a virus, It would be taken off Sourceforge long time ago.

       
      • laikvirshel

        laikvirshel - 2015-03-15

        ok thank you ^-^

         
  • gggirlgeek

    gggirlgeek - 2015-03-14

    Hi. Me too!

    Quihoo 360 came up with Heur/QVM03.0.Malware.Gen on a Full Scan but not in Virus Total.

    VT comes up with 6 hits now.
    https://www.virustotal.com/en/file/297a43a94d17dcb21377a056cd30516ecfd3489ced150df4026005c793d77127/analysis/1426362147/

     
    • Jose Antonio Diaz Jimenez

      Thanks for pointing this out.
      As you can see only some AV mark it as virus.
      I'm still looking a proper fix for this.

       
  • Jose Antonio Diaz Jimenez

    Ok, seems like besides accessing HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters, the other reason is I'm using a .Net obfuscator to protect FoxSpeed from reverse enginnering/decompilation, ConfuserEx https://yck1509.github.io/ConfuserEx/

    So, some AV software does not like this, as they think it might be some kind of encripted virus. but as You all can see if FoxSpeed was a Virus it would be detected by Avast, ESET NOD32 and Kaspersky, as some of the best AV I know.

    I think I will be switching to another Obfuscator and also a way to sign and authenticate FoxSpeed (but this cost money I currently don't have)

    Stay tuned for upcoming changes and thanks for the feedback and support.

     
    • laikvirshel

      laikvirshel - 2015-03-19

      I have to ask. °-°
      Sourceforge is an open source platform, and you're telling that you need to obfuscate the compilation of your program.
      I understand that you maybe developped something in that program that you want maybe to sell, but if I understand well it's quite contradictory with the platform.

       
      • Jose Antonio Diaz Jimenez

        I know it is contradictory, but that's how I decided to go with it.
        I hope you understand.

         

Log in to post a comment.

MongoDB Logo MongoDB