About Packer.XComp.A false positive as Virus listed in AntiVirus Databases
Hello it's me again Packer.XComp.A, BitDefender was give me this Name on 13. Feb. 2008 and mark me to be a Virus his Friend Ikarus was follow a few days later. I am one year old, my true name is XComp/XPack I'm a freeware PE32-imagefile packer/rebuilder please analyze me again and pack random Files.exe
Im a FREEWARE EXE PACKER my Name is Xcomp I am 1 Year old and this is the story how BitDefender via VirusTotal called me to be a Virus with the name Packer.XComp.A on 13 Feb 2008.rar
If I am a Virus your name is Johann the butler and your analysis is wrong.
I'm here: soft-lab.de/JoKo/ExePack.htm
Don't touch me if you belief I am dangerous or want any outgoing or incoming network connections. I don't want anything online cause I'm done to make big files smaller. Maybe my heuristic is a little bit high but not more as UPX in version > 1.9
Someone did some terrible tests with me. Believe it or not but they was unpack some files done with PECompact using the option to injected/select a dll and some other packers (my Memory requirement are not very high so I forgot if there was commercial Packers between). A pe explorer tool show after unpacking: "Warning! Import section follows the Resource section." After that I have compressed the unpacked files and ignored the warning "this file is already packed with PECompact,... and others", there was some rests inside left by unpacking. Later some wrong signatures with other packer names was come to my packed output files (it' wasn't me) and finally got submitted to VirusTotal. What was follow you can figure out. The AV results played crazy by every different signature shown a different result.
At this time no one was known or read the news by VirusTotal by them blog page, that they possible forward all files and results (experimenting include). That was the end as my signature as packer/compressor was end up in the list of viruses. I'm sorry for that tests but that was not me as packer alone.
I did my job to pack the files as little tool XComp.
I was a subject to test AntiVirus Software but they forgot to care about anonymity.
Maybe you can now imaginate why I am in the positive Virus Database by packer name Packer.XComp.A even if I do not have or produce any kinds of viruses as packer/compressor freeware tool. I think I am wrong on place there.
Im a FREEWARE EXE PACKER my Name is Xcomp I am 1 Year old and this is the story how BitDefender via VirusTotal called me to be a Virus with the name Packer.XComp.A on 13 Feb 2008.rar
If I am a Virus your name is Johann the butler and your analysis is wrong.
I'm here: soft-lab.de/JoKo/ExePack.htm
Don't touch me if you belief I am dangerous or want any outgoing or incoming network connections. I don't want anything online cause I'm done to make big files smaller. Maybe my heuristic is a little bit high but not more as UPX in version > 1.9
Someone did some terrible tests with me. Believe it or not but they was unpack some files done with PECompact using the option to injected/select a dll and some other packers (my Memory requirement are not very high so I forgot if there was commercial Packers between). A pe explorer tool show after unpacking: "Warning! Import section follows the Resource section." After that I have compressed the unpacked files and ignored the warning "this file is already packed with PECompact,... and others", there was some rests inside left by unpacking. Later some wrong signatures with other packer names was come to my packed output files (it' wasn't me) and finally got submitted to VirusTotal. What was follow you can figure out. The AV results played crazy by every different signature shown a different result.
At this time no one was known or read the news by VirusTotal by them blog page, that they possible forward all files and results (experimenting include). That was the end as my signature as packer/compressor was end up in the list of viruses. I'm sorry for that tests but that was not me as packer alone.
I did my job to pack the files as little tool XComp.
I was a subject to test AntiVirus Software but they forgot to care about anonymity.
Maybe you can now imaginate why I am in the positive Virus Database by packer name Packer.XComp.A even if I do not have or produce any kinds of viruses as packer/compressor freeware tool. I think I am wrong on place there.
1 comments:
Es ist von Antivirus zu Antivirus Software unterschiedlich. Manche haben eine Haltbarkeit, wenn man das so sagen kann, von 5 - 7 Jahre bis ein alter einst als Virus identifiziert geloscht wird. Man sieht das wenn man die Anzahl der bekannten Viren in Antivirus Programmen von den 90zigern vergleicht. Es mag sein das einige Firmen lediglich Ubereinstimmungen in den Dateien suchen und dann einen gemeinsammen Nenner geben welcher einen Virusnamen ausmacht. Anhang diesen dann zu einer Datenbank hinzugefugt wird.
Manche setzen ein Grundsystem ein indem sie daruber hinaus den Namen eines moglichen Viruses anhang anderer Kriterien je nach Datei verschieden erzetzen. Dies ueberdeckt den eigentlichen Namen und veranschaulicht dann Dateimerkmale mit unterschiedlichen Namen als Virus. Theoretisch konnte man Programme die eine Dateistruktur verandern wie es exe Packer tun insbesondere bei noch unbekannten neuen, diese sehr schnell als Virus listen lasten indem man weitere "fake" Signaturen injekziert oder gar eine handvoll unterschiedliche Dateien mit zufalligen Signaturen von tatsachlichen Viren versieht. Damit hat man die Entwicklung eines exe Pack programs sofort am Boden als Virus gelistet. Weitere Analysen gibt es nicht sobald einst ein Program als Virus Macher, Verursacher identifiziert wurde auch wenn es dem so falsch erfolgte. Meist sollte dann der Program Author selbst mit der Software Firma Kontack aufnehmen und unter Umstanden den Quellcode herausgeben. Es sind nicht alle Antivirus Programme gleich. Das Beispiel jedoch veranschaulicht hervoragend welche zusammen spielen nicht nur im Zeitramen und eventuell gleiche Quellen wie Virustotal.com heranziehen bei dem Versuch soviel wie moglich als Virus zu listen dabei spielt es keine Rolle ob es die Tatsache entspricht den es verkauft sich besser wenn die Anzahl bekannter Viren in deren Datenbank sehr hoch ist. Ich wurde auf die altesten antivirus Hersteller zuruck greifen die es bereits seit DOS Zeiten gibt da diese eigens ausgereifte Systeme haben und sich nicht an andere im Wettbewerb richten. Dabei ist Norton Symantec und McAfee immer noch sehr gut wenn es um Falschalarm geht um ein Feuer zu loschen wo keines ist bedarf es nicht Streichholz fallen zu lassen.
Post a Comment
We would appreciate if you as readers of our blog, show us some feedback by signing up to this site with Friend Connect.
This will encourage us to publish updates in the future.