Author Topic: Getting fed up with this false positive EVOGEN !!!!!!!!!!!!!!!!  (Read 2210 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
Getting fed up with this false positive EVOGEN !!!!!!!!!!!!!!!!
« on: January 28, 2015, 02:05:24 PM »
Every year this false positive EVOGEN re-appears in my programs (compiled with Delphi7).
This is terribly annoying and disgusting when an AVAST user sends you a mail telling that your programs or your computer are infected with that EVOGEN.
I can't stand this anymore ! Terrible ! Each time, each year, I have to resend my programs to the AVAST support and ask them to fix their virus definition file. Each time they fix the problem but in the meantime you have got a very bad opinion of yourself by potential users of your programs.
Not very fair from AVAST !!!!!!!! 
Gabriel

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76036
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Getting fed up with this false positive EVOGEN !!!!!!!!!!!!!!!!
« Reply #1 on: January 28, 2015, 02:12:45 PM »
Best you sign your programs.
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31079
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: Getting fed up with this false positive EVOGEN !!!!!!!!!!!!!!!!
« Reply #2 on: January 28, 2015, 02:13:52 PM »
https://blog.avast.com/tag/evo-gen/

Better a false positive than a infection ;)

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33915
  • malware fighter
Re: Getting fed up with this false positive EVOGEN !!!!!!!!!!!!!!!!
« Reply #3 on: January 28, 2015, 09:51:11 PM »
Eddy is right.
Loads  of viruses are written in Delphi.
So for instance make sure you do not have Win32.Induc delphi virus,
which changes SysConst.dcu so that all applications you compile will be infected.
Use http://virusscan.jotti.org/ and not VT which may accumalate FP detections.
(e.g. such as WriteProcessMemory).
Try to localize in your programming code the FP API calls that may trigger a scanner.
Make changes to a test application so it will no longer flag general heurictics.
Know that a lot of FP in Delphi are caused because of obfuscation in packers.
The routine often is take no chanced with obfuscation flag first evaluate a FP report later.
Info credits go to  user478955

polonus

« Last Edit: January 28, 2015, 09:53:01 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!