RE: Re: _ATL_MIN_CRT triggers Avast Sandbox

Nenad:

 

I author a program that uses WTL (incidentally compiled with ATL_MIN_CRT)
that at one time was diagnosed by one anti-malware version as being infected
with a Trojan.

 

I would think that many of these programs use pattern matching, and there's
tension between finding malware and "false positives" caused by finding a
common pattern in "normal" as well as "bad" code. Perhaps some malware used
ATL_MIN_CRT and the anti-malware pattern author used something in the ATL
code added with ATL_MIN_CRT as the pattern to identify the malware.  

 

The problem may just go away with an Avast pattern file update that corrects
their pattern match.  I wouldn't change anything in WTL for this.  I'd try
to contact the anti-malware vendor to report this "false positive" situation
(my attempts at this have all failed). It's good to let the ATL community
know so that the poor authors that use ATL_MIN_CRT have a chance to respond
to their users who can perhaps influence their anti-malware vendor. Having a
list of other anti-malware software that doesn't complain about ATL_MIN_CRT
might help, but I took the approach that my customers had to make their own
own decision about who to trust.  I installed the offending anti-malware and
scanned many times without finding a "hit".  One of my customers ran my
executable thru an anti-virus gauntlet web site that passed.   The whole
thing blew over after a few weeks when the anti-malware vendor made a
database update.  I never heard from them, though.

 

Dick Dievendorff

Happy WTL user

 



[Non-text portions of this message have been removed]



------------------------------------

Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/wtl/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/wtl/join
    (Yahoo! ID required)

<*> To change settings via email:
    [email protected] 
    [email protected]

<*> To unsubscribe from this group, send an email to:
    [email protected]

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/