First post, by Argent
I really would like to use wonderful dgVoodoo library in my future open-source launcher project for an old multiplayer game (of course I will ask Dege’s permission later according to redistribution rights), but I am very worried about AI antiviruses false positives for this library.
So I really want to prevent AI antiviruses from triggering on future versions of the dgVoodoo .
I was able to find out that antiviruses mark most files as malicious in the first place by the presence of dgVoodooCpl.exe due to the calls possibly it contains (according to VirusTotal):
wrote:1) EventID: 16. Sysmon Configuration Change. Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manipulate the configuration.
To be honest, I don’t quite understand what kind of dgVoodooCpl's action sysmon didn’t like.
wrote:2) Stop Windows Service. - '\sc.exe' - '\net.exe' - '\net1.exe' CommandLine contains: 'stop' […]
2) Stop Windows Service.
- '\sc.exe'
- '\net.exe'
- '\net1.exe'
CommandLine contains: 'stop'
If the dgVoodooCpl really сontains code to stop some Windows service, is it possible to refuse this action?
Of course, I understand that the most reliable ways to stop AI antiviruses false positives are:
1) Get an expensive digital signature.
2) Write endlessly to the developers of AI antiviruses.
But both actions are generally quite costly in terms of money and time.
The only free thing I can suggest is to register on VirusTotal, scan several files from dgVoodoo (primarily dgVoodooCpl.exe) and give them a positive rating. Also leave a positive comment in the community section.
Well, or figure out which dgVoodooCpl calls these damn AI antiviruses respond to.