Re: _ATL_MIN_CRT triggers Avast Sandbox
Hi Peter,
Thanks for sharing this info. Based on it, we have to conclude that there
is nothing really wrong with the _ATL_MIN_CRT code. And that is very good
thing to know.
Cheers,
Nenad
On Fri, Feb 3, 2012 at 2:46 PM, Peter Kvitek <pete@...> wrote:
> **
>
>
> Our WTL based app has millions of installations and roughly twice a year
> one
> or the other antivirus package starts flagging it as malware after virus
> definitions update. We routinely contact the antivirus vendor and they
> release an update that fixes the problem the next day or the day after.
>
> It's still very confusing for our users, so at some point I had a meeting
> with one of the big name antivirus vendors' devs trying to figure out a way
> to prevent this from happening. Unfortunately, the process they use is
> largely heuristic, so false positives are expected and there is not much we
> can do about it.
>
> In this particular case the pattern was probably acquired from the malware
> executable that happened to be built with ATL in _ATL_MIN_CRT mode.
> Anti-virus package should be smart enough to find unique pattern that
> identifies the malware executable, so bits coming from the commonly used
(Continue reading)