Are Antivirus-false-positives generated by VMprotect?

Hello!

We would like to buy your software. However, we tried your demo version and immediately after generating the first VMprotected file, the antivirus software raised an alarm and claimed the software generated by VMProtect is a Trojan horse! Well, I hope it is not!

Can you confirm that the commercial version does not generate software which is considered malware by antivirus software by simply VMprotecting “notepad.exe” or “vmprotect.exe” (the demo version on your site) and uploading the file to http://www.virustotal.com/ and posting the link? Else, we cannot use your software as our customers probably would not accept their virus scanners alerts as “false alarm”.

Thank you!

Most of antivirus don’t suspect protected files. There are still some problems with ClamAV and McAffee, but we are working on it.
You may send us the protected file and virustotal report, so we can analyze it.

Well, for example consider Cygwin’s setup.exe from Cygwin Installation :

Antivirus	Version	Last Update	Result
AVG	9.0.0.836	2010.06.24	Win32/Heur
McAfee-GW-Edition	2010.1	2010.06.24	Heuristic.BehavesLike.Win32.ModifiedUPX.F
Sophos	4.54.0	2010.06.24	Mal/EncPk-CA

Another example is the “s3gnmp.sys”, as part of the normal Windows XP installation

Antivirus  	Version  	Last Update  	Result
AntiVir	8.2.4.2	2010.06.24	TR/Crypt.XPACK.Gen
AVG	9.0.0.836	2010.06.24	Win32/NSAnti
Sophos	4.54.0	2010.06.24	Sus/Rootkit-A

I can give you the VMprotected files (I’m sure you can also easily re-create such a file).

please do that

The “setup.exe” file is already packed by UPX. We don’t recommend to protect files that is already protected. This doesn’t add security at all and may produce lot of problems. Both with stability and antivirus vendors.

Finally, we’ll anyway contact those antivirus companies to discuss such behavior.

Thank you very much! Please provide feedback (by private message or in this thread) as soon as you have any news. We’ll buy as soon as this issue is resolved. :slight_smile: