Virus scanners are right back to detecting Fusion-made EXEs as viruses already

[happygreenfrog]

I made a blank EXE a few days ago and uploaded it, and everything seemed fine. Forgot to save the MFA since it was, y'know, a blank EXE.

Then I rescanned it again and this was the results: https://www.virustotal.com/gui/file/eb1bc8fcaf90a9cbbf77e1dc3b63d3c99a3cd116cae6d8cff8 78212cafb503f0/detection

So then, out of curiosity, I made a new one, this time being sure to save the EXE. This was the results: https://www.virustotal.com/gui/file/...e489/detection

I bet if I rescan again in a few days, it'll be closer to the first results I got. Here's the MFA and the EXE in a ZIP. Using build 292.27 of CF2.5+ Dev, other settings can be seen in the MFA.

[happygreenfrog]

(update: 19 scanners now detect the new EXE too, so it's pretty close to the original results I got at this point)

[Janette5]

Yes - Norton as well - I just made an .exe of a .mfa I was helping someone with - the only extension in it was the ini file - and then made a blank .mfa with only 1 active object in it and both were removed by Norton:



Threat name: Heur.AdvML.BFull

On computers as of
12 Oct 2020 at 08:03:51

Last Used
12 Oct 2020 at 08:05:54

Startup Item
No

Launched
No

Threat type: Heuristic Virus. Detection of a threat based on malware heuristics.

(Edit: I've unquarantined the two files to indicate that I trust them - and they've been submitted to Norton.)

[Yves]

Looks like my day is going to be busy...

Curiously the Fusion runtime file does not trigger a false detection, except for Bitdefender, so I've submited them the file (as well as an empty app, which triggers a different false detection). We'll submit generated apps to the ones we see.

Please guys submit them as many applications as you can on your side too.

[Janette5]

If it helps at all:

I download a lot of small .mfa from these forums - they are all virus scanned automatically. There's no problem in any of them.

If I build .scr (screensaver) or an android .apk there is also no threats found.

Only if I build .exe

Edit: Html is fine also (limited to free version).

[CapitaineCaverne]

Bonjour j avais pas de problème jusqu'ici voila que mon antivirus ce met a jour et la c est la catastrophe tout les compilation en EXE et les trois fichier du répertoire unicode de fusion ( Inchrt.exe,stdrtdex.exe,stdrtd.exe) sont mis en quarantaine.
pour le fichier le Inchrt.exe c est pas trop grave vus que il sert que quand on utilise la compression Runtime.
je suis bien en version Beta b292.27.
en attendant j ai désactiver mon antivirus.
Bon courage Yves

[Yves]

Bonjour j avais pas de problème jusqu'ici voila que mon antivirus ce met a jour et la c est la catastrophe tout les compilation en EXE et les trois fichier du répertoire unicode de fusion ( Inchrt.exe,stdrtdex.exe,stdrtd.exe) sont mis en quarantaine.
pour le fichier le Inchrt.exe c est pas trop grave vus que il sert que quand on utilise la compression Runtime.
je suis bien en version Beta b292.27.
en attendant j ai désactiver mon antivirus.
Bon courage Yves

Par curiosité quel est l'anti-virus?

[happygreenfrog]

Best of luck, I can't imagine this is a fun situation for anybody
This itch.io prototype has a lot of false positives too https://happy-frog-games.itch.io/mirogox-mission-crash
I can send the source code too if it helps, though I'd rather not send it unless absolutely necessary and would rather only send it somewhere that only Clickteam can access it. There may not be much code yet, and I'm probably okay with sharing the controls code, but I'd rather people not have the assets I made for it so easily.

[CapitaineCaverne]

Oup j avais pense que je l'avais met dans le spot c est AVIRA.

[Yves]

Bizarre Avira n'apparaît pas dans la liste des détections sur Vitustotal, ça serait possible de leur soumettre ces 3 fichiers via l'interface d'Avira? (en général pour les fichiers en quarantaine il y a une option pour les envoyer à la maison mère de l'anti-virus) Au moins stdrtdex.exe (je crois qu'on va supprimer l'option "Compress the runtime" dans le prochain build, cette option ne sert plus à grand-chose.