Avira false detection

The Avira AntiVir is false detects kcfloop.mfx as "TR/Agent.dozw".

wow loop thing? It should be reported at once.

I don't think it's the built in loops, I think it's the old ported loop object.

It can crash your computer!

Or maybe someone made some dodgey spyware/malware etc with it and the extension got listed...

I was thinking about why a lot of anti-virus sometimes give MMF or it's extensions a bad listing and one thought was that although it is suppose to make fun multimedia apps and games some people might use it to make negative things. If that was the case the anti-virus apps would probably just list that app but also all the extensions used to make them as a virus/malware etc. It is annoying if this happens as it means a few dishonest people will mess things up for everyone else sadly.

I really doubt that Atom especially since it was only kcfloop.mfx. Why wouldn't the runtime be detected too?

And what could kcfloop.mfx be used for in a virus anyways?

If it does they would probably list everything that was in memory/temp so extensions also, i guess the runtime would not be because it would have been reported as a false positive many times before.

If that is how it would be then the extensions might still get listed like for example every time i try to run the fusion updater mcafee detects the live receiver extension as a virus but the others are fine. It just says live receiver as the virus and blocks the app from running, that would be the type of thing you would expect more likely to get listed also because it's used for downloading so if someone made a app to download viruses etc it would keep thinking it was a virus also.

It's not for certain of course which is why i said maybe and that it was just a thought but i think that type of thing might happen and i have seen similar things posted on other app/game creation tools sites so this could well be a reason why maybe. If it did since there is so many apps/viruses they list they would probably stay listed until they seen otherwise or enough people reported they were not and false positives. I know fusion updater is not a virus but mcafee has seemed to think it is for over a year or so now, as for the kcfloop.mfx extension i don't know but i guess it would depend on what someone did with it which could make the anti-virus think it was a problem.

it's probably something in the code that makes the heuristics engine suspicious

Yeah I suppose.

I used to aviod antivirus for this reason.

Mine shows up clean on 20 different anti-virus programs:
Jotti malware scan results for kcfloop.mfx

Also, nothing found on a file made with it:

Jotti malware scan results for sample app made using the Fast Loop Object

I suspect it's a combination of the fact that:

* MMF2 generated executables are executables with data appended to the end (that isn't in the EXE header)

* The data that's appended includes ZLIB compressed extensions, which are extracted at runtime

It's pretty common for a virus to hide code in an EXE in this exact way, so it's not surprising MMF2 EXEs keep getting picked up.

It's a bit concerning that certain antiviruses seem to have viruses actually called things like "win32/Adware.Clickteam". I suspect Install Creator's wide usage is to blame for this.