{"action":"created","issue":{"url":"https://api.github.com/repos/yck1509/ConfuserEx/issues/154","labels_url":"https://api.github.com/repos/yck1509/ConfuserEx/issues/154/labels{/name}","comments_url":"https://api.github.com/repos/yck1509/ConfuserEx/issues/154/comments","events_url":"https://api.github.com/repos/yck1509/ConfuserEx/issues/154/events","html_url":"https://github.com/yck1509/ConfuserEx/issues/154","id":54335940,"number":154,"title":"ConfuserEX 0.40 triggers Kaspersky malware","user":{"login":"NoRehab","id":9556753,"avatar_url":"https://avatars.githubusercontent.com/u/9556753?v=3","gravatar_id":"","url":"https://api.github.com/users/NoRehab","html_url":"https://github.com/NoRehab","followers_url":"https://api.github.com/users/NoRehab/followers","following_url":"https://api.github.com/users/NoRehab/following{/other_user}","gists_url":"https://api.github.com/users/NoRehab/gists{/gist_id}","starred_url":"https://api.github.com/users/NoRehab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NoRehab/subscriptions","organizations_url":"https://api.github.com/users/NoRehab/orgs","repos_url":"https://api.github.com/users/NoRehab/repos","events_url":"https://api.github.com/users/NoRehab/events{/privacy}","received_events_url":"https://api.github.com/users/NoRehab/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/yck1509/ConfuserEx/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/yck1509/ConfuserEx/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-01-14T15:38:19Z","updated_at":"2015-01-14T17:42:17Z","closed_at":null,"body":"When I obfuscate my app at max level and add also anti-ildasm, tamper, constants, ctrl flow, anti dump, drebug, invalid metadata, ref proxy, resoures and rename.\r\n\r\nThe app works great after being obfuscated but it triggers Kaspersky immediately.\r\n\r\nAgain this is at MAX PROTECTION:\r\n Protection:\r\nadd constants is OK\r\nadd ctrl flow is OK\r\nadd anti dump is OK\r\ndebug not OK\r\ninvalid metadata not ok\r\nref proxy not ok\r\nresources not oK\r\nrename OK"},"comment":{"url":"https://api.github.com/repos/yck1509/ConfuserEx/issues/comments/69957620","html_url":"https://github.com/yck1509/ConfuserEx/issues/154#issuecomment-69957620","issue_url":"https://api.github.com/repos/yck1509/ConfuserEx/issues/154","id":69957620,"user":{"login":"Palollo","id":10077592,"avatar_url":"https://avatars.githubusercontent.com/u/10077592?v=3","gravatar_id":"","url":"https://api.github.com/users/Palollo","html_url":"https://github.com/Palollo","followers_url":"https://api.github.com/users/Palollo/followers","following_url":"https://api.github.com/users/Palollo/following{/other_user}","gists_url":"https://api.github.com/users/Palollo/gists{/gist_id}","starred_url":"https://api.github.com/users/Palollo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Palollo/subscriptions","organizations_url":"https://api.github.com/users/Palollo/orgs","repos_url":"https://api.github.com/users/Palollo/repos","events_url":"https://api.github.com/users/Palollo/events{/privacy}","received_events_url":"https://api.github.com/users/Palollo/received_events","type":"User","site_admin":false},"created_at":"2015-01-14T17:42:17Z","updated_at":"2015-01-14T17:42:17Z","body":"I avoided that problem removing the \"anti tamper\" protection in executable modules. Example:\r\n```xml\r\n<project outputDir=\"..\\PROTECTED\" baseDir=\".\\UNPROTECTED\" xmlns=\"http://confuser.codeplex.com\">\r\n  <rule pattern=\"true\" preset=\"maximum\" inherit=\"false\"></rule>\r\n\r\n  <module path=\"lib1.dll\">\r\n  <module path=\"lib2.dll\">\r\n  <module path=\"main.exe\">\r\n    <rule pattern=\"true\" inherit=\"true\">\r\n      <protection id=\"anti tamper\" action=\"remove\" />\r\n    </rule>\r\n  </module>\r\n</project>\r\n```\r\n"}}