Re: Delphi 7 generates Mirror-4130 virus code

On 21 Nov 2005 02:44:25 -0800, "Arash Partow" <partow@xxxxxxxxx>
wrote:

>Anti-virus applications use hashes of machine code found in virii
>to detect them. Its fast and allows for simple database structures
>to store virii info instead of having a specialised algorithms for
>each variant of virus.
>
>That said most likely it just so happens that op code produced by
>that piece of source code is equating to some hash value found in
>the sophos virus DB. (aka false positive), to be sure use another
>AV and see what that says. FYI I've run the code through VET-AV
>and it doesn't seem to detect anything. btw I've got Delphi 7 with
>the final service pack - it could be producing different op code
>but I doubt it.

I bet it is producing different op code
- Arash has optimization turned off - I'll bet yours is on
.