不小心制造了病毒? [英] Accidentally created a virus?
问题描述
我经常看到这种情况发生:我用 Delphi 编写了一个应用程序，当我编译它时，病毒扫描程序告诉我我创建了一个病毒，然后立即再次删除了可执行文件.通过完全重建，首先删除 *.dcu 文件，有时只需等待即可修复，这很烦人但很容易解决.
I've seen it happen reasonably often: I write an application in Delphi and when I compile it, the virus-scanner tells me that I've created a virus and then immediately deletes the executable again. It's annoying but reasonable easy to fix by doing a full rebuild, deleting the *.dcu files first and sometimes by simply waiting.
据我所知，它发生在 Delphi 6、7、2005 和 2007 中.赛门铁克、卡巴斯基、迈克菲和 NOD32 都曾报告过这些误报.我知道这是因为 Delphi 在其 DCU 文件中添加了时间戳，而这些时间戳最终会出现在最终的可执行文件中，并且似乎是某些随机病毒签名的一部分.
It happens with Delphi 6, 7, 2005 and 2007, as far as I know. And Symantec, Kaspersky, McAfee and NOD32 have all been guilty of reporting these false positives. I know it's because Delphi adds timestamps to its DCU files and these timestamps end up in the final executable and apparently appear to be part of some random virus signature.
我不想禁用病毒扫描程序，甚至不想禁用单个文件夹或文件.我并不是真的要解决方案，但我想知道以下几点:
I don't want to disable the virus-scanner, not even for a single folder or file. And I'm not really for a solution, but am wondering about the following:
- 其他编译器是否也会出现这些误报?
- .NET 可执行文件也会发生这种情况吗?
- 其他人是否也注意到 Delphi 存在类似问题?
推荐答案
是否也会出现这些误报与其他编译器?
Do these false positives also occur with other compilers?
是的，这是过去 AutoIt 的常见问题，如本论坛帖子所述我的 AutoIt EXE 真的被感染了吗?".在包括 AutoIt 在内的大多数情况下，它源于糟糕的启发式做法.由于 AutoIt 使用免费和开放的 UPX 压缩器，它经常被误认为是同样使用 UPX 的恶意代码.
Yes, this is has been a common problem in the past for AutoIt as addressed in this forum post "Are my AutoIt EXEs really infected?". In most cases including AutoIt it stems from poor heuristic practices. Since AutoIt uses the free and open UPX compressor, it is often mistaken for malicious code that also uses UPX.
您能做的最好(可能也是唯一)的事情就是报告这些错误，以便他们改进启发式方法或至少将您的应用列入白名单.
The best (and possibly only) thing you can do is report these mistakes, so they can refine their heuristics or at least white list your app.
以下是一些流行的反病毒公司的联系信息列表.他们都声称很欣赏提交的内容，因为这有助于他们改进产品.
Below is a list of contact information for some popular anti-virus companies. They all claim to appreciate submissions as it helps them make their product better.
- AntiVir - 联系方式
- A2(A 方) - 联系方式(电子邮件地址)
- Avast! - 联系方式
- AVG - 联系方式
- BitDefender - 联系方式
- BullGuard - 联系方式
- CA Anti-Virus - 联系方式
- ClamAV - 联系方式
- ClamWin - 联系方式
- Comodo - 联系方式
- ESET 的 Nod32 - 联系方式
- eSafe - 联系方式(需要登录)
- Fortinet - 联系方式
- F-PROT - 联系方式
- F-Secure - 联系方式
- G-Data - 联系方式
- 卡巴斯基 - 联系方式
- McAfee - 联系方式(电子邮件地址)
- 诺曼 - 联系方式(电子邮件地址)
- 熊猫杀毒软件 - 联系方式
- Sophos - 联系
- 赛门铁克(诺顿) - 联系方式
- Vipre - 联系方式
- Windows Live OneCare - 联系方式
- ZoneLabs - 联系方式
- AntiVir - Contact
- A2 (A-Squared) - Contact (email address)
- Avast! - Contact
- AVG - Contact
- BitDefender - Contact
- BullGuard - Contact
- CA Anti-Virus - Contact
- ClamAV - Contact
- ClamWin - Contact
- Comodo - Contact
- ESET's Nod32 - Contact
- eSafe - Contact (login required)
- Fortinet - Contact
- F-PROT - Contact
- F-Secure - Contact
- G-Data - Contact
- Kaspersky - Contact
- McAfee - Contact (email address)
- Norman - Contact (email address)
- Panda Anti-Virus - Contact
- Sophos - Contact
- Symantec (Norton) - Contact
- Vipre - Contact
- Windows Live OneCare - Contact
- ZoneLabs - Contact
事实证明维基百科上有一个很棒的 AV 软件列表，称为 '防病毒软件列表'.它比我上面的列表更完整.
Turns out there is a great list of AV software on wikipedia, called 'List of antivirus software'. It is more complete than my list above.
Autoit 论坛的一名成员制作了 一个很棒的脚本，可以通过电子邮件将误报发送给大量 AV 供应商 以稍微自动化此过程.
A member of the Autoit Forums made a great script to e-mail a false positive to a huge list of AV vendors to automate this process a bit.
这篇关于不小心制造了病毒?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
