Are Antivirus-false-positives generated by VMprotect?

[miturn]

Hello!

We would like to buy your software. However, we tried your demo version and immediately after generating the first VMprotected file, the antivirus software raised an alarm and claimed the software generated by VMProtect is a Trojan horse! Well, I hope it is not!

Can you confirm that the commercial version does not generate software which is considered malware by antivirus software by simply VMprotecting "notepad.exe" or "vmprotect.exe" (the demo version on your site) and uploading the file to http://www.virustotal.com/ and posting the link? Else, we cannot use your software as our customers probably would not accept their virus scanners alerts as "false alarm".

Thank you!

[Support]

Can you confirm that the commercial version does not generate software which is considered malware by antivirus software

Most of antivirus don't suspect protected files. There are still some problems with ClamAV and McAffee, but we are working on it.
You may send us the protected file and virustotal report, so we can analyze it.

[miturn]

You may send us the protected file and virustotal report, so we can analyze it.

Well, for example consider Cygwin's setup.exe from http://cygwin.com/setup.exe :

• Without VMprotect, there are 0/40 false positives: http://www.virustotal.com/analisis/7299 ... 1277346287
• With VMprotect, there are 3/40 false positives: http://www.virustotal.com/analisis/24dd ... 1277382821

  Code: Select all

  Antivirus	Version	Last Update	Result
  AVG	9.0.0.836	2010.06.24	Win32/Heur
  McAfee-GW-Edition	2010.1	2010.06.24	Heuristic.BehavesLike.Win32.ModifiedUPX.F
  Sophos	4.54.0	2010.06.24	Mal/EncPk-CA
  

Another example is the "s3gnmp.sys", as part of the normal Windows XP installation

• Without VMprotect, there are 0/40 false positives: http://www.virustotal.com/analisis/1ddc ... 1276960616
• With VMprotect, there are 3/41 false positives: http://www.virustotal.com/analisis/ea18 ... 1277383850

  Code: Select all

  Antivirus  	Version  	Last Update  	Result
  AntiVir	8.2.4.2	2010.06.24	TR/Crypt.XPACK.Gen
  AVG	9.0.0.836	2010.06.24	Win32/NSAnti
  Sophos	4.54.0	2010.06.24	Sus/Rootkit-A
  

I can give you the VMprotected files (I'm sure you can also easily re-create such a file).

[Support]

I can give you the VMprotected files

please do that

[Support]

I can give you the VMprotected files (I'm sure you can also easily re-create such a file).

The "setup.exe" file is already packed by UPX. We don't recommend to protect files that is already protected. This doesn't add security at all and may produce lot of problems. Both with stability and antivirus vendors.

Finally, we'll anyway contact those antivirus companies to discuss such behavior.

[miturn]

Finally, we'll anyway contact those antivirus companies to discuss such behavior.

Thank you very much! Please provide feedback (by private message or in this thread) as soon as you have any news. We'll buy as soon as this issue is resolved.