Re: Re: _ATL_MIN_CRT triggers Avast Sandbox

Hi Dick,

I agree completely with you.

The only people that can help here are guys working on Avast, that they
don't seem to be very helpful. That is really too bad. At this point we can
only wait and see if there are any changes.

Cheers,
Nenad




On Sat, Jan 21, 2012 at 6:33 AM, Dick Dievendorff <[email protected]>wrote:

> **
>
>
> Nenad:
>
> I author a program that uses WTL (incidentally compiled with ATL_MIN_CRT)
> that at one time was diagnosed by one anti-malware version as being
> infected
> with a Trojan.
>
> I would think that many of these programs use pattern matching, and there's
> tension between finding malware and "false positives" caused by finding a
> common pattern in "normal" as well as "bad" code. Perhaps some malware used
> ATL_MIN_CRT and the anti-malware pattern author used something in the ATL
> code added with ATL_MIN_CRT as the pattern to identify the malware.
>
> The problem may just go away with an Avast pattern file update that
> corrects
> their pattern match. I wouldn't change anything in WTL for this. I'd try
> to contact the anti-malware vendor to report this "false positive"
> situation
> (my attempts at this have all failed). It's good to let the ATL community
> know so that the poor authors that use ATL_MIN_CRT have a chance to respond
> to their users who can perhaps influence their anti-malware vendor. Having
> a
> list of other anti-malware software that doesn't complain about ATL_MIN_CRT
> might help, but I took the approach that my customers had to make their own
> own decision about who to trust. I installed the offending anti-malware and
> scanned many times without finding a "hit". One of my customers ran my
> executable thru an anti-virus gauntlet web site that passed. The whole
> thing blew over after a few weeks when the anti-malware vendor made a
> database update. I never heard from them, though.
>
> Dick Dievendorff
>
> Happy WTL user
>
>
> [Non-text portions of this message have been removed]
>
>  
>


[Non-text portions of this message have been removed]



------------------------------------

Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/wtl/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/wtl/join
    (Yahoo! ID required)

<*> To change settings via email:
    [email protected] 
    [email protected]

<*> To unsubscribe from this group, send an email to:
    [email protected]

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/