Posts: 1663
Threads: 5
Joined: September 26, 2018
Reputation:
12
RE: Windows defender has, once again, incorrectly identified my program as malware!
February 20, 2024 at 8:55 pm
Virus checkers get very uptight about compilers. I've had problems with them flagging a compiler that used CLANG as a virus.
Posts: 2020
Threads: 133
Joined: July 26, 2017
Reputation:
5
RE: Windows defender has, once again, incorrectly identified my program as malware!
February 21, 2024 at 8:23 am
(February 20, 2024 at 8:46 pm)Ravenshire Wrote: (February 20, 2024 at 9:48 am)FlatAssembler Wrote: Yesterday, I ported my solution of the N Queens Puzzle from the WebAssembly dialect of AEC (which I wrote back in 2021) to the x86 dialect of AEC. And Windows Defender complains that the executable is malware known as "Program:Win32/Wacapew.C!ml". That's implausible, as Wacapew.C!ml is a Trojan, and not a virus which can infect other executable files.
This is not the first that has happened to me. Back in 2020, Windows Defender claimed that my "100 Bottles of Beer" program written in x86 dialect of AEC is a Trojan and that my Polar Rose program is a PUS. I submitted those files to Microsoft, and they agreed with me that it is a false positive.
I must admit I don't understand how that's even possible. I'd understand if my compiler gets misidentified as a virus, as some viruses (especially on Linux) output assembly code and invoke assemblers, and my compiler also outputs assembly and invokes assemblers. I understand that encryption software sometimes gets misidentified as ransomware, as ransomware also do encryption. But I don't understand how can such simple software that essentially does nothing get misidentified as malware. How do antivirus programs even work? What do they look for so that small example programs written in my programming language look suspicious to them?
And why aren't the producers of antivirus software held liable for the damage their software causes via false positives?
Ima just leave this here:
Switching to Linux doesn't exactly solve that problem. ClamAV, the antivirus software you get with Linux, also has many false positives. It once labeled MatLab as malware, causing me to lose many hours of work (because I had to do a laboratory exercise using MatLab from home, as physical laboratory exercises were cancelled due to the pandemic).
Posts: 2020
Threads: 133
Joined: July 26, 2017
Reputation:
5
RE: Windows defender has, once again, incorrectly identified my program as malware!
February 21, 2024 at 8:28 am
(February 20, 2024 at 8:55 pm)HappySkeptic Wrote: Virus checkers get very uptight about compilers. I've had problems with them flagging a compiler that used CLANG as a virus.
But what's weird to me is that it's not only my compiler that gets labeled as malware, but also the programs compiled by my compiler. Windows Defender has labeled the "bottles.exe" as a Trojan, "rose.exe" as Potentially Unwanted Software and "nQueensPuzzle.exe" as a Trojan.
Posts: 2020
Threads: 133
Joined: July 26, 2017
Reputation:
5
RE: Windows defender has, once again, incorrectly identified my program as malware!
February 21, 2024 at 8:29 am
(February 20, 2024 at 11:31 am)Thumpalumpacus Wrote: Why write lines that essentially do nothing, by your own admission?
To test my compiler, and to provide example programs written in my programming language.
Posts: 2020
Threads: 133
Joined: July 26, 2017
Reputation:
5
RE: Windows defender has, once again, incorrectly identified my program as malware!
February 21, 2024 at 10:03 am
(February 20, 2024 at 11:15 am)BrianSoddingBoru4 Wrote: (February 20, 2024 at 9:48 am)FlatAssembler Wrote: Yesterday, I ported my solution of the N Queens Puzzle from the WebAssembly dialect of AEC (which I wrote back in 2021) to the x86 dialect of AEC. And Windows Defender complains that the executable is malware known as "Program:Win32/Wacapew.C!ml". That's implausible, as Wacapew.C!ml is a Trojan, and not a virus which can infect other executable files.
This is not the first that has happened to me. Back in 2020, Windows Defender claimed that my "100 Bottles of Beer" program written in x86 dialect of AEC is a Trojan and that my Polar Rose program is a PUS. I submitted those files to Microsoft, and they agreed with me that it is a false positive.
I must admit I don't understand how that's even possible. I'd understand if my compiler gets misidentified as a virus, as some viruses (especially on Linux) output assembly code and invoke assemblers, and my compiler also outputs assembly and invokes assemblers. I understand that encryption software sometimes gets misidentified as ransomware, as ransomware also do encryption. But I don't understand how can such simple software that essentially does nothing get misidentified as malware. How do antivirus programs even work? What do they look for so that small example programs written in my programming language look suspicious to them?
And why aren't the producers of antivirus software held liable for the damage their software causes via false positives?
What are we supposed to do with this information?
Boru
Stop believing the common misconception that antivirus false positives are rare. And try to guess why the vendors of antivirus software aren't held liable for the damage they cause with false positives.
Posts: 46176
Threads: 539
Joined: July 24, 2013
Reputation:
109
RE: Windows defender has, once again, incorrectly identified my program as malware!
February 21, 2024 at 11:31 am
(February 21, 2024 at 10:03 am)FlatAssembler Wrote: (February 20, 2024 at 11:15 am)BrianSoddingBoru4 Wrote: What are we supposed to do with this information?
Boru
Stop believing the common misconception that antivirus false positives are rare. And try to guess why the vendors of antivirus software aren't held liable for the damage they cause with false positives.
You say that like it’s something I should care about.
Boru
‘I can’t be having with this.’ - Esmeralda Weatherwax
Posts: 2020
Threads: 133
Joined: July 26, 2017
Reputation:
5
RE: Windows defender has, once again, incorrectly identified my program as malware!
February 21, 2024 at 12:53 pm
(February 21, 2024 at 11:31 am)BrianSoddingBoru4 Wrote: (February 21, 2024 at 10:03 am)FlatAssembler Wrote: Stop believing the common misconception that antivirus false positives are rare. And try to guess why the vendors of antivirus software aren't held liable for the damage they cause with false positives.
You say that like it’s something I should care about.
Boru
Do you have antivirus software on your computer? If so, the same thing could happen to you.
Posts: 46176
Threads: 539
Joined: July 24, 2013
Reputation:
109
RE: Windows defender has, once again, incorrectly identified my program as malware!
February 21, 2024 at 12:57 pm
(This post was last modified: February 21, 2024 at 1:32 pm by BrianSoddingBoru4.)
(February 21, 2024 at 12:53 pm)FlatAssembler Wrote: (February 21, 2024 at 11:31 am)BrianSoddingBoru4 Wrote: You say that like it’s something I should care about.
Boru
Do you have antivirus software on your computer? If so, the same thing could happen to you.
Yes I do and no it couldn’t, because I don’t install your crap programmes on my computer.
Boru
‘I can’t be having with this.’ - Esmeralda Weatherwax
Posts: 16489
Threads: 127
Joined: July 10, 2013
Reputation:
65
RE: Windows defender has, once again, incorrectly identified my program as malware!
February 21, 2024 at 1:25 pm
Antivirus software only exists in prisons.
Posts: 8239
Threads: 40
Joined: March 18, 2014
Reputation:
54
RE: Windows defender has, once again, incorrectly identified my program as malware!
February 21, 2024 at 7:35 pm
(February 21, 2024 at 12:53 pm)FlatAssembler Wrote: (February 21, 2024 at 11:31 am)BrianSoddingBoru4 Wrote: You say that like it’s something I should care about.
Boru
Do you have antivirus software on your computer? If so, the same thing could happen to you.
I can't speak for anyone else, but I haven't had an anti-virus false positive, in Windoze or Linux, in well over a decade.
This sounds like yet another 'you' problem.
Thief and assassin for hire. Member in good standing of the Rogues Guild.
|