AVG says my programs are viruses (2012)

Well, this particlar peace of code does spread like a virus. It is everywhere.

Had this same issue some 5 years ago on an old system. More comprehensive answer here https://stackoverflow.com/questions/7987712/why-does-avganti...

Ok, jokes aside, how many Windows users that buy things like AVG or have an IT pro running it for them with AVG are legitimately running compilers on any computer, Windows or macOS? We are a very small fraction of end users. I was in a training this week and shocked to discover even strings, STRINGS, you need to download XCode tools now for macOS 12. I did not even bother with something more exotic. I am afraid to see what our IDS/IPS thinks of Homebrew, because ...

I know, I know, I am going to get downvoted to hell ...

But seriously, I am aware of one major IDS/IPS flags WSUS Offline Update and blocked me from downloading the zip. So that means they throw signature up there without even inspecting it I bet... to block a tool that streamlines updates on Winboxen? Thanks for protecting me!

http://download.wsusoffline.net/

This tool is open source and merely organizes different patches with common GNU and FLOSS utilties through AutoIt or some other wrappers. Many of us, who work in systems management for airgapped or systems way behind where Windows 7 updates now fail because of their recent infra changes and might even finish scanning for days[0], need this to keep updated. I get it is not a blessed tool, but I am so unqiue in this regard? I think these vendors impose their own idea of systems management, which is really variable as everyone does it their own way. Addressing that requires complexity, which is why we are here in the first place.

I handle a lot of end-user computers, so let me be clear, such behavior is atrocious. But how many of you have known/used Software Restriction Policies or AppLocker on Windows? This burning the whole forest for the trees thing is not only common, it is critical to the gimmicky heuristics nature of old school anti-virus.

Then again, Windows ships PowerShell, in a vain attempt to not be VBScript again, with Bypass features to a neat concept of signed script code, and we have things like state of the art system manipulation with blessed Microsoft tools and .NET code generation on the fly with PowerSploit, which no AV/IDS/IPS will catch without being properly tuned, since that is close enough to admin behavior (really any PowerShell) to be much harder to stop.

https://github.com/PowerShellMafia/PowerSploit/commits/maste...

[0] http://wu.krelay.de/en/ for the uninitiated

First question I would ask: what compiler are you using, and have you audited the binary it spits out. Sometimes it pays to know a little assembly and be able to use a debugger.

I'm sorry, but the quality of comments on that question is really low, apart from one. A malicious compiler can easily insert malicious code into you executable, and if you are not able to trust your compiler or read the code it generates, then you would be better off relying on the antivirus. Then again, with the prevailing mentality of most Windows users of installing packages from untrusted sources and running unknown binaries without understanding the risks, it is not surprising.