VisualWorks-1.15.exe

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

VisualWorks-1.15.exe

Maarten Mostert

Hi,

 

When doing a 7.91 install on OSX 10.6.8  with Avast free edition running I get a strange Virus warning on VisualWorks-1.15.exe in the preview bin directory ?

 

Any explanation ?

 

Regards,

 

@+Maarten,

 

https://dl.dropbox.com/u/5848367/avast.png

 

 

 

 

 


_______________________________________________
vwnc mailing list
[hidden email]
http://lists.cs.uiuc.edu/mailman/listinfo/vwnc
Reply | Threaded
Open this post in threaded view
|

Re: VisualWorks-1.15.exe

Andres Valloud-6
Maarten, from time to time we get reports along these lines.  So far,
what we noticed is that every so often we get false positive reports
from antivirus programs.

Try uploading the file to http://virscan.org and see what results you
get.  If there are significant problems found (e.g. 90% detect the same
type of malware), then we can start doing other things like making sure
you got an unmodified version of the file etc.  I just did that and I
found the following.

1.  Apparently I tried the same thing on the same file back in August of
2012, and I only got a positive report out of Avast.  They tested 36
antivirus programs back then, and only one out of 36 programs complains?
  I'd think that can be written off as a false positive.

2.  I just reuploaded the latest version, and I get 3 out of 37
antivirus complains about MS07, including Avast.  I had to ask for a
rescan because the file was the same that was uploaded before (via MD5
hash).

Huh.  I eyeballed the executable's binary and I see nothing out of the
ordinary at first glance.  For something described as a backdoor, or a
virus, or a trojan (depends on which of the 3 antivirus above you ask),
I'd expect to see a significant chunk of executable that is compressed
with some custom packer to obfuscate detection.  I do not see any such
thing.  I do not even see a lot of executable bits at all, there's just
over 4kb decompressed code (including code padding added by the compiler).

I'd send the file to Avast and ask them to explain how MS07 is present.

On 3/2/13 11:22 AM, [hidden email] wrote:

> Hi,
>
> When doing a 7.91 install on OSX 10.6.8  with Avast free edition running
> I get a strange Virus warning on VisualWorks-1.15.exe in the preview bin
> directory ?
>
> Any explanation ?
>
> Regards,
>
> @+Maarten,
>
> https://dl.dropbox.com/u/5848367/avast.png
>
_______________________________________________
vwnc mailing list
[hidden email]
http://lists.cs.uiuc.edu/mailman/listinfo/vwnc
Reply | Threaded
Open this post in threaded view
|

Re: VisualWorks-1.15.exe

Maarten Mostert

Thank you Andres,

 

That is more then enough explanation for me.

Did'nt even know that they sorted files automatically and can be so mistaken on the way.

 

Regards,

 

@+Maarten,

 

 

On Sunday, 3 March, 2013 21:43, "Andres Valloud" <[hidden email]> said:

> Maarten, from time to time we get reports along these lines. So far,


> what we noticed is that every so often we get false positive reports
> from antivirus programs.
>
> Try uploading the file to http://virscan.org and see what results you
> get. If there are significant problems found (e.g. 90% detect the same
> type of malware), then we can start doing other things like making sure
> you got an unmodified version of the file etc. I just did that and I
> found the following.
>
> 1. Apparently I tried the same thing on the same file back in August of
> 2012, and I only got a positive report out of Avast. They tested 36
> antivirus programs back then, and only one out of 36 programs complains?
> I'd think that can be written off as a false positive.
>
> 2. I just reuploaded the latest version, and I get 3 out of 37
> antivirus complains about MS07, including Avast. I had to ask for a
> rescan because the file was the same that was uploaded before (via MD5
> hash).
>
> Huh. I eyeballed the executable's binary and I see nothing out of the
> ordinary at first glance. For something described as a backdoor, or a
> virus, or a trojan (depends on which of the 3 antivirus above you ask),
> I'd expect to see a significant chunk of executable that is compressed
> with some custom packer to obfuscate detection. I do not see any such
> thing. I do not even see a lot of executable bits at all, there's just
> over 4kb decompressed code (including code padding added by the compiler).
>
> I'd send the file to Avast and ask them to explain how MS07 is present.
>
> On 3/2/13 11:22 AM, [hidden email] wrote:
> > Hi,
> >
> > When doing a 7.91 install on OSX 10.6.8 with Avast free edition running
> > I get a strange Virus warning on VisualWorks-1.15.exe in the preview bin
> > directory ?
> >
> > Any explanation ?
> >
> > Regards,
> >
> > @+Maarten,
> >
> > https://dl.dropbox.com/u/5848367/avast.png
> >
> _______________________________________________
> vwnc mailing list
> [hidden email]
> http://lists.cs.uiuc.edu/mailman/listinfo/vwnc
>

_______________________________________________
vwnc mailing list
[hidden email]
http://lists.cs.uiuc.edu/mailman/listinfo/vwnc
Reply | Threaded
Open this post in threaded view
|

Re: VisualWorks-1.15.exe

Thomas, Arden
You can report this false positive result directly to the antivirus maker at [hidden email]

It is suggested you zip up the file in question, and note you believe it is a false positive.

I have reported it and would suggest to anyone experiencing this issue to do the same.

Regards

Arden Thomas

Arden Thomas
Cincom Smalltalk Product Manager
845 296 0686

Cincom Smalltalk - It makes hard things easier, the impossible, possible

"Simplicity is the Ultimate Sophistication" - Leonardo Da Vinci

On Mar 4, 2013, at 11:22 AM, [hidden email] wrote:

Thank you Andres,

 

That is more then enough explanation for me.
Did'nt even know that they sorted files automatically and can be so mistaken on the way.

 

Regards,

 

@+Maarten,

 

 

On Sunday, 3 March, 2013 21:43, "Andres Valloud" <[hidden email]> said:

> Maarten, from time to time we get reports along these lines. So far,

> what we noticed is that every so often we get false positive reports
> from antivirus programs.
>
> Try uploading the file to http://virscan.org and see what results you
> get. If there are significant problems found (e.g. 90% detect the same
> type of malware), then we can start doing other things like making sure
> you got an unmodified version of the file etc. I just did that and I
> found the following.
>
> 1. Apparently I tried the same thing on the same file back in August of
> 2012, and I only got a positive report out of Avast. They tested 36
> antivirus programs back then, and only one out of 36 programs complains?
> I'd think that can be written off as a false positive.
>
> 2. I just reuploaded the latest version, and I get 3 out of 37
> antivirus complains about MS07, including Avast. I had to ask for a
> rescan because the file was the same that was uploaded before (via MD5
> hash).
>
> Huh. I eyeballed the executable's binary and I see nothing out of the
> ordinary at first glance. For something described as a backdoor, or a
> virus, or a trojan (depends on which of the 3 antivirus above you ask),
> I'd expect to see a significant chunk of executable that is compressed
> with some custom packer to obfuscate detection. I do not see any such
> thing. I do not even see a lot of executable bits at all, there's just
> over 4kb decompressed code (including code padding added by the compiler).
>
> I'd send the file to Avast and ask them to explain how MS07 is present.
>
> On 3/2/13 11:22 AM, [hidden email] wrote:
> > Hi,
> >
> > When doing a 7.91 install on OSX 10.6.8 with Avast free edition running
> > I get a strange Virus warning on VisualWorks-1.15.exe in the preview bin
> > directory ?
> >
> > Any explanation ?
> >
> > Regards,
> >
> > @+Maarten,
> >
> > https://dl.dropbox.com/u/5848367/avast.png
> >
> _______________________________________________
> vwnc mailing list
> [hidden email]
> http://lists.cs.uiuc.edu/mailman/listinfo/vwnc
>
_______________________________________________
vwnc mailing list
[hidden email]
http://lists.cs.uiuc.edu/mailman/listinfo/vwnc



_______________________________________________
vwnc mailing list
[hidden email]
http://lists.cs.uiuc.edu/mailman/listinfo/vwnc