2

I'm using a Linux system and cross-compiling to Win32. The most trivial Windows source code ("Hello world" by Petzold), when compiled using i686-w64-mingw32-gcc (gcc version 7.3-win32 20180312), generates a valid Windows executable; this executable runs nicely on Wine (under Linux) and on native Windows; however, when tested using Anti-Virus software, I get multiple virus detection reports.

Virustotal.com's report for the file includes:

BitDefenderTheta: Gen:NN.ZexaF.34106.x8Y@aqPOh2m
Cylance: Unsafe
Cyren: W32/Rozena.O.gen!Eldorado
Endgame: Malicious (moderate Confidence)
F-Prot: W32/Rozena.O.gen!Eldorado
Ikarus: Trojan.Win32.Rozena
Microsoft: Trojan:Win32/Wacatac.C!ml
Rising: Malware.Heuristic!ET#89% (RDMK:cmRtazr+3...

Is this reliable? Could something in the libraries I have for Wine/mingw/gcc be infected, or is this just too many false positives?

Source code: http://tal.forum2.org/helloworld.c; compiled executable: http://tal.forum2.org/helloworld.exe. Any help would be appreciated.

1

1 Answer 1

4

Your Anti-Virus (Defender or any other software) sees a virus signature in your safe file due to:

  1. Your code is compiled by minGW. Many viruses are written in C and compiled in minGW to be small. Thus, AV sees your file as a small executable written in C which uses minGW compiler call sequence. Thus, AV sees some of your code translated to compiler call sequence as a virus signature (in your case it is Trojan:Win32/Wacatac.C!ml and some others).

This is called false detect by AV-software.

What can you do in this case:

  1. Try to find which line of code in your executable creates this false-detect
  2. Report to AV developers with this problem. They should fix it adding this call sequence as a safe signature to their virus database or make exclusion (depends on software)
  • : This is not a small problem, nor is it a big problem. But it is a problem which can affect some students who write small C-programs.

  • : Also I must add that sometimes this problem can only be partly solved due to the fact that AV-developers can add SHA256 (or other) of your exact file as an exclusion. Then you create another exe with minor changes and again you have to reach out to AV-developers. Thus, for this problem to be fully solved, you have to demand from AV-developers to conduct research and create an working algorithm which prevents false detect of a small minGW-compiled files.

7
  • Thank you. My main concern was mostly that the compiler itself isn't compromised (i.e., causing me to generated infected executables).
    – Tal Cohen
    Jun 11, 2020 at 13:45
  • Linux virus in mingw library for Windows that creates malware code on Windows? I dont think such malware exists, but it is interesring idea. If you have doubts, check SHA256 of compilers and library files for consistence with the source from where you downloaded them.
    – hgrev
    Jun 12, 2020 at 14:08
  • "Many viruses are ... compiled in minGW" - Do you have a source for this? I'd never heard about it until now.
    – AJM
    Aug 16, 2023 at 9:39
  • @AJM MonGW is a popular compiler, so it's expected to lots of viruses to be compiled with it.
    – ThoriumBR
    Aug 16, 2023 at 16:44
  • @ThoriumBR I thought mingw-w64 had pretty thoroughly outcompeted the original MinGW a long time ago, to the point where it wasn't popular or widely used any more? I seem to recall its version of gcc being very out of date when I checked it in April.
    – AJM
    Aug 16, 2023 at 16:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .