Author Topic: VirusTotal and False Positives  (Read 3294 times)

ovortex

  • Newbie
  • *
  • Posts: 2
  • Karma: +0/-0
    • View Profile
VirusTotal and False Positives
« on: February 24, 2017, 07:50:57 AM »
Hello,

First of all, thanks for your great work on RetroFE!

I noticed that VirusTotal yields many alerts when scanning retrofe.exe 0.7.20:

https://www.virustotal.com/en/file/217c3b23d7ef1603afa92708ba2650dc879e7523167f96c85fafe92f881f71fa/analysis/1487921720/

Although these certainly are false positives I was wondering if anything could be done about that?

If I were to compile my own retrofe.exe would the result be the same?
Are there any compiler/project settings that could be changed so VirusTotal wouldn't report that many issues?

« Last Edit: February 24, 2017, 07:53:10 AM by ovortex »

Pieter Hulshoff

  • Administrator
  • Hero Member
  • *****
  • Posts: 1534
  • Karma: +46/-14
    • View Profile
    • Towel 42
Re: VirusTotal and False Positives
« Reply #1 on: February 24, 2017, 08:11:52 AM »
In all honesty: I have no idea. I'm running AVG myself, and as you can see in the report: no issues. You could certainly give compiling your own executable a try to see if it makes a difference. Just keep in mind that I compile with /MT so not every user needs to install Microsoft Visual Studio; that might be of influence here.

Pieter Hulshoff

  • Administrator
  • Hero Member
  • *****
  • Posts: 1534
  • Karma: +46/-14
    • View Profile
    • Towel 42
Re: VirusTotal and False Positives
« Reply #2 on: February 24, 2017, 08:26:55 AM »
I ran a quick check on my latest executable: https://www.virustotal.com/en/file/be4a3cf4ec671eac9572ffb39cd574ece987049d888f4f034885d532d76b84a5/analysis/
It's certainly cleaner, though I haven't really changed much (just a few cleanups in the code); my system itself hasn't changed.

As said: I'm not really sure what causes some virus checkers to find issues here; I heard the HyperSpin download has similar issues. I'm open to suggestions. :)

ovortex

  • Newbie
  • *
  • Posts: 2
  • Karma: +0/-0
    • View Profile
Re: VirusTotal and False Positives
« Reply #3 on: February 24, 2017, 09:27:46 AM »
Thanks for the quick reply.

Cool, your new executable apparently is already a huge improvement in this regard.

I'm a total noob when it comes to compiling stuff so I won't be of much help here.
My naive approach would include things like changing optimization levels or changing static vs dynamic linking.

I have also read about similar issues with Hyperspin and WinKawaks.
At least the latter is UPX-packed as far as I know so it's even less of a surprise virus scanners go bonkers ;)
« Last Edit: February 24, 2017, 09:29:21 AM by ovortex »