Re: Ann: A new version of Win32Forth has been released.

Newsgroups	comp.lang.forth
Date	2016-01-28 00:28 -0800
References	(3 earlier) <n76lq7$apd$1@dont-email.me> <3c0e5f6f-4ceb-493e-9bbb-8402a80d6cad@googlegroups.com> <n774fe$g7h$1@dont-email.me> <0ce48444-8035-4717-8e0a-f0ae0317742f@googlegroups.com> <b678c785-d966-48d1-be6c-0dcf074c9dd8@googlegroups.com>
Message-ID	<a08a1b75-c4df-41d0-8abd-e98c63c3f144@googlegroups.com> (permalink)
Subject	Re: Ann: A new version of Win32Forth has been released.
From	Mark Wills <markwills1970@gmail.com>

Show all headers | View raw

On Wednesday, 27 January 2016 18:13:26 UTC, novembe...@gmail.com  wrote:
> I am surprised that no one has asked the question what is it in the EXE that sets off the false positives. 
> 
> I don't have the email to hand but I am sure I read on the yahoo group that it was something to do the PE header.
> 
> Is that still the case or is it something completely different ?
> 
> NN

I don't think it's the EXE per se. The anti-virus systems in question
have noticed that when these Forth systems are running, they write into
their own (executable) memory space. This is a known technique of virus
writers, where payload code is stored in an executable in an obfuscated
format, and unpacked at trigger time to deliver its payload/penis 
enhancment advert.

This then gets reported back to the Anti Virus Mothership, and that
particular EXE signature is thus ever marked as suspicious.

Thread

Ann: A new version of Win32Forth has been released. josv@planet.nl - 2016-01-13 04:55 -0800
  Re: Ann: A new version of Win32Forth has been released. Coos Haak <chforth@hccnet.nl> - 2016-01-13 14:26 +0100
    Re: Ann: A new version of Win32Forth has been released. lehs <skydda.barnen@gmail.com> - 2016-01-13 15:02 -0800
      Re: Ann: A new version of Win32Forth has been released. rickman <gnuarm@gmail.com> - 2016-01-13 18:18 -0500
        Re: Ann: A new version of Win32Forth has been released. josv@planet.nl - 2016-01-13 15:47 -0800
          Re: Ann: A new version of Win32Forth has been released. hughaguilar96@gmail.com - 2016-01-13 18:48 -0800
            Re: Ann: A new version of Win32Forth has been released. "WJ" <w_a_x_man@yahoo.com> - 2016-01-14 03:07 +0000
          Re: Ann: A new version of Win32Forth has been released. Bernd Paysan <bernd.paysan@gmx.de> - 2016-01-14 04:28 +0100
            Re: Ann: A new version of Win32Forth has been released. josv@planet.nl - 2016-01-26 08:57 -0800
              Re: Ann: A new version of Win32Forth has been released. november.nihal@gmail.com - 2016-01-27 10:13 -0800
                Re: Ann: A new version of Win32Forth has been released. Mark Wills <markwills1970@gmail.com> - 2016-01-28 00:28 -0800
                Re: Ann: A new version of Win32Forth has been released. josv@planet.nl - 2016-01-28 03:50 -0800
        Re: Ann: A new version of Win32Forth has been released. Bernd Paysan <bernd.paysan@gmx.de> - 2016-01-14 04:17 +0100
  Re: A new version of Win32Forth has been released. "HAA" <someone@microsoft.com> - 2016-01-14 09:29 +1100
  Re: Ann: A new version of Win32Forth has been released. Gerry Jackson <gerry@jackson9000.fsnet.co.uk> - 2016-02-01 06:05 +0000
    Re: Ann: A new version of Win32Forth has been released. josv@planet.nl - 2016-02-01 04:03 -0800
      Re: Ann: A new version of Win32Forth has been released. Gerry Jackson <gerry@jackson9000.fsnet.co.uk> - 2016-02-01 13:41 +0000
        Re: Ann: A new version of Win32Forth has been released. josv@planet.nl - 2016-02-01 07:10 -0800
      Re: Ann: A new version of Win32Forth has been released. Albert van der Horst <albert@spenarnc.xs4all.nl> - 2016-02-01 15:01 +0000
        Re: Ann: A new version of Win32Forth has been released. josv@planet.nl - 2016-02-01 07:18 -0800
          Re: Ann: A new version of Win32Forth has been released. Gerry Jackson <gerry@jackson9000.fsnet.co.uk> - 2016-02-01 19:59 +0000
            Re: Ann: A new version of Win32Forth has been released. Coos Haak <chforth@hccnet.nl> - 2016-02-01 23:13 +0100
              Re: Ann: A new version of Win32Forth has been released. Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-02-02 02:09 -0500
                Re: Ann: A new version of Win32Forth has been released. Raimond Dragomir <raimond.dragomir@gmail.com> - 2016-02-02 03:55 -0800
                Re: Ann: A new version of Win32Forth has been released. Coos Haak <chforth@hccnet.nl> - 2016-02-02 14:13 +0100
                Re: Ann: A new version of Win32Forth has been released. Raimond Dragomir <raimond.dragomir@gmail.com> - 2016-02-02 06:13 -0800
                Re: Ann: A new version of Win32Forth has been released. Albert van der Horst <albert@spenarnc.xs4all.nl> - 2016-02-03 12:00 +0000
                Re: Ann: A new version of Win32Forth has been released. anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2016-02-03 12:11 +0000
                Re: Ann: A new version of Win32Forth has been released. Raimond Dragomir <raimond.dragomir@gmail.com> - 2016-02-03 07:27 -0800
                Re: Ann: A new version of Win32Forth has been released. josv@planet.nl - 2016-02-04 01:00 -0800
                Re: Ann: A new version of Win32Forth has been released. Albert van der Horst <albert@spenarnc.xs4all.nl> - 2016-02-02 14:37 +0000
                Re: Ann: A new version of Win32Forth has been released. anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2016-02-02 15:56 +0000
                Re: Ann: A new version of Win32Forth has been released. Albert van der Horst <albert@spenarnc.xs4all.nl> - 2016-02-03 12:02 +0000
                Re: Ann: A new version of Win32Forth has been released. Julian Fondren <julian.fondren@gmail.com> - 2016-02-02 08:28 -0800
                Re: Ann: A new version of Win32Forth has been released. anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2016-02-02 12:39 +0000
              Re: Ann: A new version of Win32Forth has been released. anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2016-02-02 16:52 +0000
                Re: Ann: A new version of Win32Forth has been released. Chris Curl <ccurl609@gmail.com> - 2016-02-02 14:11 -0800
                Re: Ann: A new version of Win32Forth has been released. Coos Haak <chforth@hccnet.nl> - 2016-02-03 01:50 +0100
                Re: Ann: A new version of Win32Forth has been released. Chris Curl <ccurl609@gmail.com> - 2016-02-03 05:56 -0800
  Re: Ann: A new version of Win32Forth has been released. pandoraefretum@googlemail.com - 2016-02-10 13:38 -0800
    Re: Ann: A new version of Win32Forth has been released. josv@planet.nl - 2016-02-11 06:53 -0800

csiph-web