Board:   [fsxNet] BBS Software Development/Support
Subject: Re: Draw32 - RELEASED!
From:    RetroSwim(21:2/150)
Date:    Wed Aug 05, 2026 06:21

 Ex> The !ml suffix means it was flagged by Microsoft's machine-learning
 Ex> heuristic model, not a signature match to a known-malicious sample.
 Ex> Sabsik is a generic/heuristic detection family, notorious for
 Ex> false-positiving

Related story: For a while, this heuristic "virus" detection was the bane of my existence.

A sub-project of VogonsDrivers is a wrappers collection, containing mostly DLLs that coerce 3D libraries to play together (e.g. enabling 3Dfx Glide games to render to OpenGL on any hardware)

Since many, if not most of these are designed to sit in a game's directory and intercept/hook function calls, many malware scanners, not just Defender, would flag these files with similar cryptic, nasty-sounding "virus names".

For a time I had to deal with the web hosting company emailing me with security alerts, asking me to delete or clean files. In every case they would accept my explanation of the false positive and leave it be, but the next day I'd inevitably have a slew of new emails.

In the end, I moved the whole site to a VPS that I manage.

It would benefit everybody if they clearly identified these "guesses" as
such, and not with obtuse, scary names like Trojan:Win32/Sabsik.FL.A!ml

Cheers,
RetroSwim

--- Mystic BBS v1.12 A49 2024/05/29 (Linux/64)
 * Origin: 2o fOr beeRS bbs>>>20ForBeers.com:1337 (21:2/150)
.