{"action":"created","issue":{"url":"https://api.github.com/repos/yck1509/ConfuserEx/issues/375","labels_url":"https://api.github.com/repos/yck1509/ConfuserEx/issues/375/labels{/name}","comments_url":"https://api.github.com/repos/yck1509/ConfuserEx/issues/375/comments","events_url":"https://api.github.com/repos/yck1509/ConfuserEx/issues/375/events","html_url":"https://github.com/yck1509/ConfuserEx/issues/375","id":118720194,"number":375,"title":"After confusing my exe file with ConfuserEX AVIRA antivirus detects TR/Dropper.MSIL.Gen virus inside new generated exe","user":{"login":"agilestep","id":5655186,"avatar_url":"https://avatars.githubusercontent.com/u/5655186?v=3","gravatar_id":"","url":"https://api.github.com/users/agilestep","html_url":"https://github.com/agilestep","followers_url":"https://api.github.com/users/agilestep/followers","following_url":"https://api.github.com/users/agilestep/following{/other_user}","gists_url":"https://api.github.com/users/agilestep/gists{/gist_id}","starred_url":"https://api.github.com/users/agilestep/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/agilestep/subscriptions","organizations_url":"https://api.github.com/users/agilestep/orgs","repos_url":"https://api.github.com/users/agilestep/repos","events_url":"https://api.github.com/users/agilestep/events{/privacy}","received_events_url":"https://api.github.com/users/agilestep/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-24T22:46:51Z","updated_at":"2015-11-25T00:44:50Z","closed_at":null,"body":""},"comment":{"url":"https://api.github.com/repos/yck1509/ConfuserEx/issues/comments/159449605","html_url":"https://github.com/yck1509/ConfuserEx/issues/375#issuecomment-159449605","issue_url":"https://api.github.com/repos/yck1509/ConfuserEx/issues/375","id":159449605,"user":{"login":"MurariAlex","id":11204378,"avatar_url":"https://avatars.githubusercontent.com/u/11204378?v=3","gravatar_id":"","url":"https://api.github.com/users/MurariAlex","html_url":"https://github.com/MurariAlex","followers_url":"https://api.github.com/users/MurariAlex/followers","following_url":"https://api.github.com/users/MurariAlex/following{/other_user}","gists_url":"https://api.github.com/users/MurariAlex/gists{/gist_id}","starred_url":"https://api.github.com/users/MurariAlex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MurariAlex/subscriptions","organizations_url":"https://api.github.com/users/MurariAlex/orgs","repos_url":"https://api.github.com/users/MurariAlex/repos","events_url":"https://api.github.com/users/MurariAlex/events{/privacy}","received_events_url":"https://api.github.com/users/MurariAlex/received_events","type":"User","site_admin":false},"created_at":"2015-11-25T00:44:50Z","updated_at":"2015-11-25T00:44:50Z","body":"One of the protections provided by ConfuserEx is the anti-tamper, which encrypts the methods of your assembly. The antiviruses cannot verify the actions of the methods of your EXE when they are encrypted to tell that they are \"safe\" and your app isn't harmful. On top of that, many malware authors do use ConfuserEx to protect their apps, so the antivirus companies detect the protection system as a virus since thay can't assure that your program isn't harmful.\r\n\r\nNow my notes on that:\r\n- The **JIT** anti-tamper is ***always*** detected as a virus.\r\n- The **normal** anti-tamper, depending on your app, and other protections like control flow ***may*** not be detected as a virus. Changing and customizing the other protections settings of ConfuserEx somehow \"fools\" the antiviruses. In my case, depending on the level and depth of control flow, my app may or may not trigger the anti-virus.\r\n- Small apps and DLLs, like console apps tend to trigger the antivirus more often."}}