Date:	Thu, 22 Jul 1999 10:53:06 +0300 (IDT)
From:	Eli Zaretskii <eliz AT is DOT elta DOT co DOT il>
X-Sender:	eliz AT is
To:	Adam Lawrence <guruman AT sprint DOT ca>
cc:	djgpp AT delorie DOT com
Subject:	Re: Allegro/DJGPP and false virus alerts
In-Reply-To:	<kXjl3.28941$jl.23809560@newscontent-01.sprint.ca>
Message-ID:	<Pine.SUN.3.91.990722105245.14732H-100000@is>
MIME-Version:	1.0
Reply-To:	djgpp AT delorie DOT com
X-Mailing-List:	djgpp AT delorie DOT com
X-Unsubscribes-To:	listserv AT delorie DOT com

On Wed, 21 Jul 1999, Adam Lawrence wrote:

>     I've tried a bunch of scanners on my home PC (NAV, PC-cillin,
> InoculateIT, and AntiViral Toolkit) which say everything is clean. I copied
> two different programs I've written using DJGPP and Allegro to an unused
> disk to test them out on a PC at work. The work PC, which uses Cheyenne,
> claims that they're infected with Cold3927 and can't clean them. Any program
> I've written that uses Allegro and DJGPP seem to trigger it.

This is a bug in your anti-virus software, please update it to the
latest version, and if that doesn't help, complain to the vendor.

There was a similar thread about Cold3927 false alarms a few months
ago, you can find it by searching the DJGPP mail archives at
http://www.delorie.com/djgpp/mail-archives/.  You will see that
eventually, the vendor admitted it was their bug.

The problem is that the DJGPP stub loader, that 2KB-long DOS code
prepended to each DJGPP program, is optimized for size, and so does
several tricks that some overzealous virus scanners take as a sign of
a virus.

- Raw text -