DotNetCompressor icon indicating copy to clipboard operation
DotNetCompressor copied to clipboard

Antivirus false positives

Open sp00n opened this issue 4 years ago • 1 comments

This looked promising, but unfortunately several antivirus programs pick up .exes compressed with this tool as malware/trojans/malicious/etc. Probably as it was used by malware authors as well. Unfortunately this basically makes it useless. :(

This is a small exe I just created: image

sp00n avatar Apr 14 '21 14:04 sp00n

Sorry to hear this :/ While this is one of my most popular modules, it's actually one I never expected to gain any traction 😅

You could try seeing if https://github.com/roachadam/bytepress is able to resolve your immediate search.

On the topic of malware false positives, one could try to modify the mechanism for decompression & evaluation, but I'm not sure if this would yield positive results as the decompress / deobfuscate -> invoke assembly pattern is a common technique used by viruses to try to avoid detection (clearly it doesn't work anymore).

If I adjusted the code, some of the false positives might let up (which is why I recommended bytepress), but the heuristic-based ones would still likely flag this pattern.

I'll consider playing around with it a bit to see if I could get the module functioning again.

TotalTechGeek avatar Apr 18 '21 05:04 TotalTechGeek