AVG says my programs are viruses (2012)

http://www.cplusplus.com/forum/beginner/67634/

by shubhamjain • 10 years ago

43 32 10 years ago

rocketier• 10 years ago

Well, this particlar peace of code does spread like a virus. It is everywhere.

stinos• 10 years ago

Related: amount of questions on StackOverflow answered with 'disable your antivirus'. Especially Avast it seems from just scanning through http://stackoverflow.com/search?q=disable+avast (which anecdotally I've indeed seen cause all kinds of havoc including blue screens).

iKlsR• 10 years ago

Had this same issue some 5 years ago on an old system. More comprehensive answer here https://stackoverflow.com/questions/7987712/why-does-avganti...

thedoctor792• 10 years ago

I'm sorry, but the quality of comments on that question is really low, apart from one. A malicious compiler can easily insert malicious code into you executable, and if you are not able to trust your compiler or read the code it generates, then you would be better off relying on the antivirus. Then again, with the prevailing mentality of most Windows users of installing packages from untrusted sources and running unknown binaries without understanding the risks, it is not surprising.

userbinator2• 10 years ago

How many malicious compilers have you actually seen in the wild (in 2012, when that post was written)? And indeed if there were any, why would an AV not just detect the compiler itself?

douche• 10 years ago

AVG is a threat. When you can't uninstall a piece of software completely with normal means and have to start ripping it out by the roots with special tools, there's something wrong.

616c• 10 years ago

Ok, jokes aside, how many Windows users that buy things like AVG or have an IT pro running it for them with AVG are legitimately running compilers on any computer, Windows or macOS? We are a very small fraction of end users. I was in a training this week and shocked to discover even strings, STRINGS, you need to download XCode tools now for macOS 12. I did not even bother with something more exotic. I am afraid to see what our IDS/IPS thinks of Homebrew, because ...

I know, I know, I am going to get downvoted to hell ...

But seriously, I am aware of one major IDS/IPS flags WSUS Offline Update and blocked me from downloading the zip. So that means they throw signature up there without even inspecting it I bet... to block a tool that streamlines updates on Winboxen? Thanks for protecting me!

http://download.wsusoffline.net/

This tool is open source and merely organizes different patches with common GNU and FLOSS utilties through AutoIt or some other wrappers. Many of us, who work in systems management for airgapped or systems way behind where Windows 7 updates now fail because of their recent infra changes and might even finish scanning for days[0], need this to keep updated. I get it is not a blessed tool, but I am so unqiue in this regard? I think these vendors impose their own idea of systems management, which is really variable as everyone does it their own way. Addressing that requires complexity, which is why we are here in the first place.

I handle a lot of end-user computers, so let me be clear, such behavior is atrocious. But how many of you have known/used Software Restriction Policies or AppLocker on Windows? This burning the whole forest for the trees thing is not only common, it is critical to the gimmicky heuristics nature of old school anti-virus.

Then again, Windows ships PowerShell, in a vain attempt to not be VBScript again, with Bypass features to a neat concept of signed script code, and we have things like state of the art system manipulation with blessed Microsoft tools and .NET code generation on the fly with PowerSploit, which no AV/IDS/IPS will catch without being properly tuned, since that is close enough to admin behavior (really any PowerShell) to be much harder to stop.

https://github.com/PowerShellMafia/PowerSploit/commits/maste...

[0] http://wu.krelay.de/en/ for the uninitiated

Kenji• 10 years ago

Reminds me of those old times when Norton Anti Virus automatically quarantined the binaries of empty Borland Delphi GUI projects. Eventually I just got rid of my antivirus altogether because it kept having false positives.

thedoctor792• 10 years ago

First question I would ask: what compiler are you using, and have you audited the binary it spits out. Sometimes it pays to know a little assembly and be able to use a debugger.

speeder• 10 years ago

I stopped using automatic anti-viruses.

SPECIALLY AVG and Avast.

Last time I tried to use them, they immediately deleted without asking if I allowed it, 80% of my tools and binaries.

It is clear that anti-viruses on Windows are usually more dangerous than the viruses themselves. (in the end, the virus I wanted to track down, was in my router, not on Windows :/)

xroche• 10 years ago

It is clear that anti-viruses on Windows are usually more dangerous than the viruses themselves

This is especially true regarding the bad track record of antivirus software w.r.t vulnerabilities, allowing an attacker to elevate its privileges.

vram223• 10 years ago

Can you elaborate?

brudgers• 10 years ago

I've been using Microsoft's free anti-virus products on my Windows machines since Microsoft first started offering them. Third party anti-virus shares many of the features of malware: difficult to remove; runs at root level; user tracking; self-updating; and in subscription versions comes with the proposition of pay up or we will make your computer vulnerable.

On the other hand, Microsoft's interests are less misaligned with mine. They want to keep Windows secure as do I. Around the edges of tracking and telemetry, we may disagree. Anyway, my life became much simpler when I adopted Microsoft's solution for my Windows boxes.

vram223• 10 years ago

I've been using Microsoft's free anti-virus products on my Windows machines since Microsoft first started offering them.

Since when did they start offering it? and is it Windows Defender you are talking about? - thanks.

gravypod• 10 years ago

This also could just be a test sample that's in the system. There are a few test codes for antiviruses and these companies may be using these as test binaries.

userbinator2• 10 years ago

I remember when MingW or Cygwin users were complaining that AVs were detecting "Hello world" binaries as malware too.

IMHO AVs started becoming anti-user when they began detecting "hacking tools" and keygens/cracks/patches (there are certainly some which do have malware, but detecting software that does exactly what it claims to do is going beyond that.) That's acting in the interests of corporations, not users. It's rather authoritarian and I don't want that at all.

digi_owl2• 10 years ago

They kinda had to, because of the rising popularity of Spybot and Malwarebytes.

vram223• 10 years ago

Are you saying that Malwarebytes is a malware?

user59944613• 10 years ago

I don't believe that the average user's computer should have hacking tools on it.

kazagistar• 10 years ago

Irrelevant. The purpose of an antivirus is not to make a user conform to an average user, its to detect unwanted software. If the user obtains a keygen for some software, what business does an antivirus have with it?

willstrafach• 10 years ago

You may be misunderstanding. The "hacking tools" phrase likely refers to what others might call "penetration testing tools" and/or tools used for reverse engineering.

korzun• 10 years ago

I remember the day I tried to open an ASM Phrozen Crew demo and anti-virus automatically deleted it after flagging it as critical malware.

esrauch• 10 years ago

they began detecting "hacking tools" and keygens/cracks/patches

I think the context here is that a lot of this software contains malware (even the ones that also do what they say on the tin), and its a lot harder to separate since the deliberate intent is "modify the workings of other programs". It becomes nearly impossible to algorithmically decide if it is modifying other programs"in the way the user wanted rather than any undesired way.

hubetcha• 10 years ago

In my experience it is not enough to disable third party Antivirus - it has to be completely uninstalled. At least one major AV (can't remember which) still leaves its TCP/IP hooks in the kernel even when disabled making network traffic several times slower. Customers are aghast at the suggestion that AV is the problem - surely you are the one with the bad code. They think AV couldn't possibly slow all disk and net accesses by an order of magnitude.

Pica_soO• 10 years ago

At our university we had a virus scanner who would without information and warning, simply delete freshly compiled assembler executable. It was fun, finding that out. The desk should still have marks where i gnawed on it.

TazeTSchnitzel• 10 years ago

About a decade ago, I made a tiny little executable in Delphi so I could browse the hard drive contents on school computers, which otherwise hide it from Windows Explorer using group policy. Mischievous and definitely against school rules, but harmless.

The school antivirus had a false-positive and decided it was some particular virus. God knows how.

mmastrac• 10 years ago

This reminds me of my adventures with Avira's terrible web heuristics half a decade ago:

https://grack.com/blog/2010/03/17/the-sorry-state-of-avira-a...

AVG says my programs are viruses (2012)

Related Stories