[Tinycc-devel] Re: TCC generating false positive?

[grischka]

address@hidden wrote:
>    Hi, grischka,
>
> McAfee VirusScan Enterprise 8.7.0i ALSO detects a virus W32/Zhelatin.gen 
> immediately as soon as hello_dll.exe is generated.

Using tcc.exe from the release:

$ tcc -v examples/dll.c -shared
tcc version 0.9.24
-> examples/dll.c
<- dll.def (1 symbols)
<- dll.dll (2048 bytes)

$ tcc -v examples/hello_dll.c dll.def
tcc version 0.9.24
-> examples/hello_dll.c
-> dll.def
<- hello_dll.exe (2048 bytes)

$ md5sum hello_dll.exe dll.dll
f86e5ff3d1b9cba96679f8b4654eb445 *hello_dll.exe
6a797c617d2559f6fb411d54330d7252 *dll.dll

Now to be sure that your file is not a virus (and that AV software
is stupid really) you'd just need to check their md5 sum on your
computer.

Btw. the md5 results are just the same when cross-compiled with tcc
on linux also which now again not so likely has a W32 virus.

> I would think that it is unlikely that two different anti-malware makers
> would detect a virus (on two separate machines) if there were not one.
> I would think that they would not use the same detection strings.
> Sounds a lot less like a false positive to me at this point.
>
> If you don't know how to fix it, perhaps you can get some help from an
> anti-virus maker.
>
> Perhaps it just needs to be recompiled in a C compiler other than itself
> to break the cycle of passing on the virus?
>
> I like TCC but I am surely not interested in creating infected apps.
> It's embarrassing.
>
>
> -----Original Message-----
> From: grischka <address@hidden>
> To: address@hidden
> Sent: Wed, 7 Jan 2009 5:41 pm
> Subject: Re: Fwd: TCC generating false positive?
>
> address@hidden <mailto:address@hidden> wrote:
>  > grischka,
>  > > Can you help me out? (See below).
>  > ....
>  >> When I tried the .dll example in the TCC readme, my "Spyware Doctor"
>  >> detected "E-mail-Worm.Zhelatin!sd5" on the generated executable as soon
>  >> as it was created. This did NOT happen though if I just did a plain
>  >> "tcc hello.c" ... only if I did the .dll example. I tried changing the
>  >> example but the result was the same no matter what I tried.
>  >> >> Of course, it is likely that this is a false positive, but I thought
>  >> that I would report this to you anyway so you can check it out.
>  >> >> Should you wish to contact PC Tools about this, here is where you
> can
>  >> report the problem:
>  >> >> http://www.pctools.com/mrc/dispute/
>
> Sorry, I don't have that problem. So there is no way for me
> to figure out what could be the reason.
>
> Regards.