my c++ project deleted by Trend Micro Antivirus! :O

Hi all,

i compile my c++ program it was 700KB and i want it smaller not more than 400KB.. i searched the web google and find many EXE Compressor programs

everyone that i used Trend Micro cached like a virus.. the best program called ASPack V2.28:
Software protection download
http://www.aspack.com/files/aspack228.zip

but also Trend think it is a virus.. when asked in google they said Trend think it a virus because you compressed it.. is it problem?

ok anyone know a program compress c++ exe files without warning?
help please

UPX? Anyway, do you really need this requirement? A difference of 300 KB does not seem particularly earth shattering these days.

O_o

I'm going to go out on a limb and say you downloaded a patched copy of ASPack that is infected with a malicious loader.

Soma

Thanx allot laserlight.. :) u made me sad in my last thread.. now thanxfull
yes i need it really..
I used it UPX 3.08w.. but

still saying infected when compressed it.. its TrendMicro 9.200
anyway to encrypt from TrendMicro ? or reslove it?

Quote:

---

Originally Posted by phantomotap

O_o

I'm going to go out on a limb and say you downloaded a patched copy of ASPack that is infected with a malicious loader.

Soma

---

no it's not.. because antivirus be quiet till compressed it saying infected.. the ASPack is clean

Get a "better" virus locker?

Soma

Quote:

---

Originally Posted by phantomotap

Get a "better" virus locker?

Soma

---

My project is a shareware.. am not doing it just for myself
friends and others may use it

they would think i shared a virus.. :)

If you are putting a binary online for technology savvy users to download you need a Jotti certificate of something similar.

Soma

than you SOMA :)
any way to compress it in c++ ?

"If it uses a packer, it's malware."

The above heuristic is about 99.999% accurate. You should be happy your anti-virus has this rule, it protects you from a vast number of terrible things.

Don't use packers. Even the "professional" ones are used almost exclusively by bad guys.

You have a point in bringing up "Better safe than sorry!" but everything else is unnecessary "FUD".

For the virus control software to do the job it was designed to do it has to inspect the real executable code for different bits. If the real executable code is compressed via a packer then part of the job is unpacking the real executable code. The algorithms and extra structures used by most major executable packers are well documented and widely available. For custom made packers or those using encryption layered over a packer the virus software needs to run the executable in a debugging layer or isolation mechanism of some kind.

Again, I agree with the "Better safe than sorry!" concept, but if the "Trend Micro" software can't recognize a virus free file simply because it is packed with "UPX" (I know for certain that "Trend Micro" has the logic to unpack "UPX" files.) I wouldn't expect it to be able to recognize a file carrying a virus.

Saying "If is uses a packer it should mark it as a virus to be on the safe side." is flawed from the outset; if the virus control software isn't capable of looking at or at least isolating the real executable code hiding beneath a packer with a known implementation it can't be trusted to look at any executable and determine if a file carries a virus.

So, yeah, "Better safe than sorry!" is spot on; when your virus software can't look underneath a packer it can't be trusted so "Better safe than sorry!" here means installing different virus control software.

And, I am well aware that no virus control software is perfect, but protected installers for "Windows" that use a signed packer to decompress certain files are common as dirt. If "UPX" confuses "Trend Micro" I can't imagine that it knows what to do with these installers beyond screaming "Virus!" just in case.

Soma

Both ASpack and UPX use techniques like IAT obfuscation and anti-debugging mechanisms which have absolutely nothing to do with compressing your executable, and everything to do with making the packer itself more difficult to reverse engineer. The packers are designed this way because the people making the packers know damn well who uses them and what they need.

This is an arms race. On the other side, we have continuous advances in automated unpacking, such as W-X tracing. In turn, the packers invent more elaborate techniques to annoy the auto-unpackers, such as VM multi-mapping. You're kidding yourself if you think any of this has to do with providing the simple service of compressing executable files.

Yeah, I work in this space.

Quote:

---

Yeah, I work in this space.

---

I don't care, but if true you should know better.

Saying "About 99.999% of packed binaries are malicious." is "FUD". There is no argument to made for your statements.

Look at this thread as an example; we have someone who clearly isn't all that savvy talking about how his virus control software flagged his own code as a virus. Is he going to continue to trust that software? Maybe. It will cause problems.

I've gotten tons of "tickets" because some code I wrote was flagged as a virus. Why? Because it was game and I didn't want people cheating. I used the many of those same techniques to protect the binary copy on disc. Some people stopped trusting me because of the virus control software did not do its job. Other people stopped trusting the virus control software which resulted in infections.

I'm all for warning people about the realities of the many, many jerks who want to cause harm. Spreading "FUD" about malicious code works for those jerks. You want to work against them don't spread "FUD"; it sends absolutely the wrong message in every conceivable way.

[Edit]
*shrug*

Actually, you know what? Everything you said only serves to prove my point.

You say it is an arms race? Okay. Then I have to ask, how much better could my advice of "Get new software if your current virus control software can't do its job." be?
[/Edit]

Soma

Quote:

---

i compile my c++ program it was 700KB and i want it smaller not more than 400KB

---

This is a requirement that doesn't make any sense. 15 years ago, I would have understood packing something below 1.44mb. 10 years ago, packing something below 600mb would have been normal. Today... even packing something to fit into 9gb is hardly done anymore. There is only one scenario in which I can see packing executable code and I'm quite happy that a virus scanner will flag it.

Quote:

---

Originally Posted by phantomotap

Saying "About 99.999% of packed binaries are malicious." is "FUD". There is no argument to made for your statements.

---

That is not what I said. I said that in the vast majority of cases the heuristic makes the correct decision. It is about the rate of dissemination, not the proportion.

A possibly ridiculous example: People either wear a white shirt (not packed) or a black shirt (packed). You're in a room with 33 people who are "good" and who wear white shirts. There are another 33 people who are "good" and who wear black shirts. And another 33 people who are "bad" and wear black shirts. Everybody moves about randomly in the room, but "bad" people run while the rest walk slowly. You will bump into people. If you bump into somebody wearing a white shirt, the chance of them being bad is 0, as no bad guys wear white shirts. If you bump into somebody wearing a black shirt, you might first think the chance of them being bad is only 50%, but it is actually greater than that, because the bad guys are moving faster and thus you bump into them more frequently. Therefore "black shirt == bad" is a better heuristic than "black shirt == good," even though there are equal numbers of good and bad who wear black shirts.

Sorry if I upset you somehow. It seems like you have had bad experiences where anti-malware software has caused you actual problems. I assure you that I don't work for an anti-virus company or any such thing, I just have experience with this in the context of a specific piece of software for which I am responsible for security, and I am just calling it as I see it. My view of the topic is necessarily a windowed one.