Virus/trojan false positives: SMLRC has many false positives on Windows

https://www.virustotal.com/gui/file/e96b3b77fe77d643ba8c3eea4f1a1b35ffe532cab6bfd65bb4b9b75264640554/detection

[alexfru]

How do you fix stupid?

Ouch!

[alexfru]

Right, stupid antiviri. I don't know how to fix them.

Let's keep this issue open and see if anyone knows how.

Anyways, did you mean to insult me on purpose?

[alexfru]

@Shineonline I'm very sorry, stupid was not directed at you at all. Stupid is how those AVs are made and work.

It's OK, I take mild insults like paper balls to the chest anyways

[alexfru]

So, here's the problem as I understand it...

Figuring out what a program does or if it's somehow malicious is a problem that does not have a cheap solution (it's NP complete or some such). It's generally impossible to tell if a program even terminates or loops forever (see the halting problem).

Instead those AVs rely more on finding code/data patterns that have already been seen in malicious or infected software. This is a much cheaper "solution". Those (sub)patterns, however, can be benign, hence false positives and the quotation marks. The thinking goes, as long as popular software like Windows itself isn't affected by false positives, all is fine. While this is helpful on the large scale of things, this approach can't work satisfactorily with arbitrary and never before seen software.

I have played with the PE file structure a bit, but so far haven't found a reliable way to generate executables without false positives per virustotal. Even the simplest hello-world-like programs written in assembly (e.g. FASM demos) are flagged for no good reason.

Unless someone figures out the precise pattern that the virustotal minions dislike, this issue isn't going to be resolved. Also, there may be something in the generated code and not the file format/structure. I'm definitely not going to write a vastly different code generator just to fix that.

[alexfru]

There's one clue, the "Rich header", which I haven't tried. OTOH, not every compiler generates it, since it's officially undocumented nor is functionally required.

[alexfru]

With the latest changes in .EXE generation there are some notable improvements:

Before improvements, as of commit 4f1ab17,
false positives from virustotal.com:
n2f.exe 12/66
smlrc.exe 34/67
smlrl.exe 24/69
smlrpp.exe 28/71
smlrcc.exe 24/67

After improvements, as of commit 1776503,
false positives from virustotal.com:
n2f.exe 16/69
smlrc.exe 8/66
smlrl.exe 6/67
smlrpp.exe 23/69
smlrcc.exe 7/67

You should still keep the issue open, but that's an improvement

[alexfru]

virustotal seems to be fncking with us. At first, after another round of improvements in PE generation, it shows a good low number of false positives, then, 3 days later it magically finds another 10-15 false positives that it didn't show the first time. WTF.

[o0101]

I think the idea is then to not make these online virus counters a metric of quality for your product. Ignore them? :)

Develop independently of them seems a good idea. As you first said, "How do you fix stupid?"