Re: _ATL_MIN_CRT triggers Avast Sandbox

Hi Peter,

Thanks for sharing this info. Based on it, we have to conclude that there
is nothing really wrong with the _ATL_MIN_CRT code. And that is very good
thing to know.

Cheers,
Nenad





On Fri, Feb 3, 2012 at 2:46 PM, Peter Kvitek <[email protected]> wrote:

> **
>
>
> Our WTL based app has millions of installations and roughly twice a year
> one
> or the other antivirus package starts flagging it as malware after virus
> definitions update. We routinely contact the antivirus vendor and they
> release an update that fixes the problem the next day or the day after.
>
> It's still very confusing for our users, so at some point I had a meeting
> with one of the big name antivirus vendors' devs trying to figure out a way
> to prevent this from happening. Unfortunately, the process they use is
> largely heuristic, so false positives are expected and there is not much we
> can do about it.
>
> In this particular case the pattern was probably acquired from the malware
> executable that happened to be built with ATL in _ATL_MIN_CRT mode.
> Anti-virus package should be smart enough to find unique pattern that
> identifies the malware executable, so bits coming from the commonly used
> library or framework cannot be part of it.
>
> /Peter
>
> From: [email protected] [mailto:[email protected]] On Behalf Of Nenad
> Stefanovic
> Sent: Thursday, January 19, 2012 6:11 PM
>
> To: [email protected]
> Subject: [wtl] _ATL_MIN_CRT triggers Avast Sandbox
>
> Hi everybody,
>
> I have Avast 6.0 anti-virus and I noticed that now Avast triggers Sandbox
> for apps built with _ATL_MIN_CRT. Any apps, including projects that do
> nothing but display a window. I contacted Avast support, but they were not
> helpful at all.
>
> Has anybody else noticed this? Any ideas why is this happening?
>
> I think this is an important issue. If the problem is a real one, WTL
> should then drop support for _ATL_MIN_CRT.
>
> Cheers,
> Nenad
>
> [Non-text portions of this message have been removed]
>
> [Non-text portions of this message have been removed]
>
>  
>


[Non-text portions of this message have been removed]



------------------------------------

Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/wtl/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/wtl/join
    (Yahoo! ID required)

<*> To change settings via email:
    [email protected] 
    [email protected]

<*> To unsubscribe from this group, send an email to:
    [email protected]

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/