RE: _ATL_MIN_CRT triggers Avast Sandbox

Our WTL based app has millions of installations and roughly twice a year one
or the other antivirus package starts flagging it as malware after virus
definitions update. We routinely contact the antivirus vendor and they
release an update that fixes the problem the next day or the day after.

 

It's still very confusing for our users, so at some point I had a meeting
with one of the big name antivirus vendors' devs trying to figure out a way
to prevent this from happening. Unfortunately, the process they use is
largely heuristic, so false positives are expected and there is not much we
can do about it.

 

In this particular case the pattern was probably acquired from the malware
executable that happened to be built with ATL in _ATL_MIN_CRT mode.
Anti-virus package should be smart enough to find unique pattern that
identifies the malware executable, so bits coming from the commonly used
library or framework cannot be part of it.

 

/Peter

 

 

From: [email protected] [mailto:[email protected]] On Behalf Of Nenad
Stefanovic
Sent: Thursday, January 19, 2012 6:11 PM
To: [email protected]
Subject: [wtl] _ATL_MIN_CRT triggers Avast Sandbox

 

  

Hi everybody,

I have Avast 6.0 anti-virus and I noticed that now Avast triggers Sandbox
for apps built with _ATL_MIN_CRT. Any apps, including projects that do
nothing but display a window. I contacted Avast support, but they were not
helpful at all.

Has anybody else noticed this? Any ideas why is this happening?

I think this is an important issue. If the problem is a real one, WTL
should then drop support for _ATL_MIN_CRT.

Cheers,
Nenad

[Non-text portions of this message have been removed]





[Non-text portions of this message have been removed]



------------------------------------

Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/wtl/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/wtl/join
    (Yahoo! ID required)

<*> To change settings via email:
    [email protected] 
    [email protected]

<*> To unsubscribe from this group, send an email to:
    [email protected]

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/