Welcome, Guest
Username: Password: Remember me
  • Page:
  • 1

TOPIC:

Virus? 19 Oct 2022 21:52 #24218

  • jacekm23
  • jacekm23's Avatar
  • Topic Author


  • Posts: 9
  • Hi,
    I installed XSharp Cahors 2.13 - Public verion and my antivirus program detected a virus. What do you think about this?

    Jacek

    Please Log in or Create an account to join the conversation.

    Virus? 19 Oct 2022 23:09 #24219

    • Chris
    • Chris's Avatar


  • Posts: 3759
  • Hi Jacek,

    Maybe MS do not like competition against VS :) :) :)

    No idea why they flag this, but if you don't use XIDE, just delete it and you should be fine.
    XSharp Development Team
    chris(at)xsharp.eu

    Please Log in or Create an account to join the conversation.

    Virus? 20 Oct 2022 12:33 #24222

    • ArneOrtlinghaus
    • ArneOrtlinghaus's Avatar


  • Posts: 337
  • We suffer quite often under the problem that one of the many different virus scanners and -versions in the world signals an error in one of our dlls or exes. It happens even if the dlls are certified.
    A good check is to open
    www.virustotal.com/
    and upload the program. It makes an immediate control with many virus scanners. If none of these or only the one you are using flags the file, then probably it is the virus scanner that did not the correct detection.

    Arne

    Please Log in or Create an account to join the conversation.

    Virus? 20 Oct 2022 14:20 #24223

    • ic2
    • ic2's Avatar


  • Posts: 1574
  • Hello Arne,

    A good check is to open
    www.virustotal.com/
    and upload the program. It makes an immediate control with many virus scanners. If none of these or only the one you are using flags the file, then probably it is the virus scanner that did not the correct detection.

    That's a great link you provide. We created one program which is also available (and hence checked) for the Microsoft Store which is flagged as MachineLearning/Anomalous.96% by Malwarebytes. I once mailed them but they don't reply to that, I have to start some procedure.

    There's absolutely nothing in my program which could trigger a virus scanner so my trust in Malwarebytes disappeared. I uploaded the program and apart from MalwareBytes and SecureAge, unknown to me, the other 70 scanners did not detect any problem. Hence this is also a good site to test the reliability of virus scanners.

    Dick

    Please Log in or Create an account to join the conversation.

    Virus? 21 Oct 2022 21:19 #24242

    • Jamal
    • Jamal's Avatar


  • Posts: 303
  • Chris,

    If a program file is not Code Signed, this may trigger a false-positive; this is from experience.
    Also, programs that are obfuscated might also get flagged as containing viruses even though they are clean!

    Jamal

    Please Log in or Create an account to join the conversation.

    Virus? 23 Oct 2022 07:12 #24247

    • Chris
    • Chris's Avatar


  • Posts: 3759
  • Hi Jamal,

    Yeah, I've also heard about .Net apps using Reflection (XIDE indeed uses that a lot) also triggering antiviruses. But I'm not really interested in fighting against all this mafness, if antiviruses want to flag XIDE, then so be it.
    XSharp Development Team
    chris(at)xsharp.eu

    Please Log in or Create an account to join the conversation.

    Virus? 28 Oct 2022 10:46 #24281

    • ArneOrtlinghaus
    • ArneOrtlinghaus's Avatar


  • Posts: 337
  • Even code signed programs are not treated always as "good programs" anymore.
    We had cases where we had to ask the antivirus company explicitly to whitelist our signed programs.
    But it is Ok to have some "False positives" some times. Better than having once one single "False negative" (an undetected virus). :angry: ;)

    Please Log in or Create an account to join the conversation.

    Virus? 28 Oct 2022 17:46 #24283

    • Jamal
    • Jamal's Avatar


  • Posts: 303
  • Hi Arne,

    In the past, we discussed Large Address Aware (LLA) for 32-bit programs. One issue which triggered the false-positive was that I code signed the program, however, during installation, I used a script to run a C# console app to update the VO EXE to be LAA. However, the code signing of the VO EXE got lost; and I verified this by looking for the Digital Signature in the Windows Explorer properties dialog of the VO program and it was gone. So, now I make the EXE LAA before bundling in the installer. In my case, this eliminated the virus issue.

    Jamal

    Please Log in or Create an account to join the conversation.

    Virus? 28 Oct 2022 17:55 #24284

    • Jamal
    • Jamal's Avatar


  • Posts: 303
  • Hi Chris,

    Do you code sign your XIDE program?

    If not, I can understand, however, code signing builds trust that the program has not been tampered during transit with and it came from a trusted source.
    I am usually very hesitant to install any program that is not code signed. The risk is just too high!

    But I'm not really interested in fighting against all this mafness, if antiviruses want to flag XIDE, then so be it.


    Jamal

    Please Log in or Create an account to join the conversation.

    Last edit: by Jamal.

    Virus? 28 Oct 2022 18:05 #24285

    • Chris
    • Chris's Avatar


  • Posts: 3759
  • Hi Jaml,

    Indeed, no code signing, it does not even haven a proper "license agreement" or anything like that, it's purely a "use it if you really, really want to" thing.
    XSharp Development Team
    chris(at)xsharp.eu

    Please Log in or Create an account to join the conversation.

    • Page:
    • 1