HotFinger icon indicating copy to clipboard operation
HotFinger copied to clipboard

False detections by antivirus software

Open resilar opened this issue 6 years ago • 0 comments

In VirusTotal, 6/67 engines falsely detect hotfinger.exe as malicious. This is bad because the 6 engines include popular antivirus software such as Avast, AVG, Cylance & Symantec. Users do not like this, so do something about it. Possible solutions:

  1. Carefully modify HotFinger to resolve false positives one by one. However, this is non-trivial because 4 out of the 6 false detections are based on heuristics (that is, cannot be addressed by changing few bytes in the hotfinger.exe executable).

  2. Do not modify HotFinger itself, but use existing packer/protector to make hotfinger.exe undetectable. Writing a custom "dropper" is also an option.

resilar avatar Jan 10 '19 19:01 resilar