Inquiry About Enigma Protector and Antivirus Detection

[freecounters]

Hello,

I hope you're doing well.

I read on the forum that the Enigma Protector program is detected as a virus by some antivirus software. In response, you recommended that users report the file as a false positive.

However, two questions have been on my mind:

This issue is undoubtedly due to part of your protection algorithm triggering these detections. Why don’t you modify that part yourselves?

Surely, antivirus programs flag protected files as viruses based on certain technical criteria. If the files were actually infected, wouldn’t reporting them as false positives be a security risk?

Thank you for your explanations regarding these questions.

[GameShield]

This issue is undoubtedly due to part of your protection algorithm triggering these detections. Why don’t you modify that part yourselves?

Where did you get this nonsense from? This is a problem with all protectors, not just Enigma.

[freecounters]

Hi
Yes, you're absolutely right.
However, for example, in WinLicense, if you uncheck the 'Compress and encrypt application' option, you won't have virus detection error.
This indicates that this part of its algorithm is problematic.
That's why I asked why the Enigma Protector development team isn't working on this problematic part themselves.

Also, the issue I mentioned has no conflict with the valid point you raised.
I’ll wait for an explanation from the Enigma Protector development team.
Thanks.

[Enigma]

This issue is undoubtedly due to part of your protection algorithm triggering these detections. Why don’t you modify that part yourselves?

Surely, antivirus programs flag protected files as viruses based on certain technical criteria. If the files were actually infected, wouldn’t reporting them as false positives be a security risk?

Hi, sure, there is our opinion on that.

First of all, I would clarify that this is a wrong detection, aka false positive detection. There is no any kind of virus, or malicious code inside any protected file.

Why that happens? Many reasons, main of them:
- antiviruses can't analyze protected files well, so it is more easy for them to detect something inside any protected file, than try to unpack and reverse the original code. Stronger protection may produce more false positive detections;
- virus makes also use protection systems to protect viruses against to be detected, so if antivirus finds that some virus is protected with protection, based on protected file signature (which is same for all protected files) they produce same detection for other files;
- some tricks, that protection is used to make the file more difficult to analyze are also used by viruses, so some antiviruses, when detect such tricks, detect something in protected files too.

Why code compression does not trigger false detection? Worth to believe, but due to your luck only. There is no any option in protection that allows to avoid false positive detection. You could try to protect the file once again after a minute and wrong detection may gone. Please understand, if we could make such feature, we definite already made that, but it is impossible. Any false detection - this is error of antivirus, this is not an our fault and nothing we could affect. But, if you strongly sure that code compression may affect it somehow, then in Enigma Protector you could use the option Miscellaneous - Other - Do not compress and encrypt code, it does what you need.

How to fix wrong detection?
1. Use code signing to sign protected file with code signing certificate. Any OV or EV certificates are good. Apart of all advantages that code signing gives, it also allows to avoid false positive detections.
2. Submit protected file to antivirus engineers, ask to fix problem. You know about this way.
3. Do not use virustotal to check the file after each protection. Virustotal is used not only by antivirus developers, but also by virusmakers. By defaults, uploaded files are marked by antivirus as malicious, and more submitted samples produce more wrong detections. We had a cases, when submitting file to virustotal that caused just couple of false detections, after a week become wrongly detected by almost all vendors there. This is known as cascading false detection, when vendors produce wrong detection just based on a wrong detection of another, bigger antivirus vendor.
4. Discussing that with antivirus developers, they advised us that wrong detection may automatically be cleaned up. If more users are using your file, then more chances antiviruses will clean it up automatically, without any notice or effort.

What Enigma Protector does against false detection?

Enigma Protector has internal signature in each protected file, that could determine the customer, who protected the file. There is no any personal information inside protected file, but there is some kind of signature. This signature names taggant. This one is known by some of antiviruses and used by them to track customers who protect viruses, or to determine if the file is protected with demo version or licensed one. Some antiviruses are using this information and do not detect anything in the files protected with licensed version.

[bngvtkraxj]

弹弹堂科洛斯希望OL一条龙www.81uv.com915515538@qq.com红月十二之天(江湖OL)服务端出售

火线任务(Heat Project)sf服务端飞飞OLsf服务端洛汗sf服务端天之炼狱sf服务端
丝路传说sf服务端大话西游sf服务端蜀门sf服务端机战sf服务端剑侠情缘sf服务端
绝对女神sf服务端传说OLsf服务端刀剑sf服务端弹弹堂sf服务端科洛斯sf服务端
魔力宝贝sf服务端武林外传sf服务端网页游戏sf服务端页游sf服务端希望OLsf服务端
天龙sf服务端奇迹Musf服务端魔兽sf服务端魔域sf服务端墨香sf服务端
天堂2sf服务端传奇3sf服务端英雄王座sf服务端千年sf服务端征途sf服务端
新魔界sf服务端骑士sf服务端烈焰sf服务端破天sf服务端决战sf服务端
美丽世界sf服务端乱勇OLsf服务端倚天2sf服务端完美世界sf服务端征服sf服务端
天堂sf服务端传世sf服务端真封神sf服务端劲舞团sf服务端天上碑sf服务端
永恒之塔sf服务端仙境ROsf服务端诛仙sf服务端神泣sf服务端石器sf服务端
冒险岛sf服务端惊天动地sf服务端热血江湖sf服务端问道sf服务端密传sf服务端
成吉思汗sf服务端剑侠世界sf服务端全民奇迹sf服务端挑战OLsf服务端
红月sf服务端十二之天(江湖OL)sf服务端倚天sf服务端dnfsf服务端
————————————————————————————————
力争做到传奇开服一条龙最TOP公司,最信誉的一条龙制作商,GM开服必选老品牌,用诚信和技术实力赢得客户,这里不强制广告,不强制充值平台。很多被骗后才来我这。不管你上多少钱广告都与我无关！充值平台随便选,不存在黑单！主营项目:手游端游页游套餐版本一条龙开区+服务器租用+网站论坛建设+广告宣传代理