Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Is there a way to avoid having my obfuscated application looking like a virus

When I obfuscate my application the antivirus gives a virus alert for the obfuscated application.

What can I do to avoid this?

I am using Visual Studio 2008 and .NET Reactor 3.9.8.0 on Windows XP Professional.

Windows and applications are up to date, and antivirus finds nothing when running a complete scan.

EDIT: Avast Antivirus gives an alert. MS Forefront does not.

EDIT 2: Changing the Control Flow Obfuscation level fixed it.

like image 753
Leander Avatar asked Mar 17 '09 09:03

Leander


2 Answers

Some EXE-compressors/obfuscators/other tools are treated as malware by antivirus programs as they are often used to compress/encrypt/hide viruses. Try to use a different program for obfuscating. If the problem persists, you could also try to change your code a bit, perhaps one of your code pattern looks suspicious to the antivirus program.

EDIT: After a quick search, I found no false alarm reports from other users for .NET Reactor - you could also try to report the problem to the EZIRIZ support - maybe they know more about this.

like image 178
schnaader Avatar answered Sep 24 '22 08:09

schnaader


I got into the same situation, this time with Avast and REACTOR 4.7.0. Unchecking Control Flow obfuscation did nothing.

It was the NATIVE EXE File option (which injects WIN32 startup code to replace the standard CLR startup code). Reported to EZIRIZ and AVAST.

Curious thing was that the exe file (obtained while desactivating Avast) was scanned and declared clean ... by Avast.

like image 21
peter.cyc Avatar answered Sep 23 '22 08:09

peter.cyc