Avast

I’m getting Avast antivirus detecting my script as false positive virus threat.

my config used to be:

      	rotateUnicodeArray: true
		,
	compact: true,
	controlFlowFlattening: false,
	deadCodeInjection: false,
	debugProtection: false,
	debugProtectionInterval: false,
	disableConsoleOutput: true,
	rotateStringArray: true,
	selfDefending: true,
	stringArray: true,
	stringArrayEncoding: 'base64',
	stringArrayThreshold: 0.75,
	unicodeEscapeSequence: false

I also tried “lowest” settings, but it still detected as false positive. Forgone the obfuscation altogether and it stopped complaining.

[sanex3339]

Hi. After some tests i noticed that Avast triggered when string literals are moving to the string array from objects keys that had computed property with false value.

Obfuscator doing transformation of object keys:

var foo = {
    bar: 'baz'
};

into this form:

var foo = {
    'bar': 'baz'
};

And then moving this string literal ‘bar’ to the string array. So, on your code after moving object keys to string array - avast will detect your code as the threat.

Solution - enable stringArrayEncoding: 'base64' With this option enabled - all antivirus checks are negative. Tested on 0.10.2 version.

[sanex3339]

Also i wrote letter to Avast about false positive alerts. Will waiting for response.