Packers and Microsoft Defender

[NON]

Originally Posted by argie

Heya!

I recently have lot of issues with MSDefender deleting packed files. Packer is not pirated and there is no malware inside.

I literally wrote a "Hello World" program, packed it and immediately Defender flagged it as "Win32:Trojan-[pseudovariant] with threat level SEVERE.

This is quite annoying and I tried tons of different stuff to make it not detect but it is persistent like crazy. I even submitted the file to Microsoft and they marked it clean and removed from detection but after packing again and new 'pseudovariant' is detected. It's crazy.

Does anyone have any advice or atleast something to attempt to escape the Defender detection?

I tried the packed file on VirusTotal and it has like 13 detections (false postives) but nobody uses those AVs. But Defender is a bit different, it is used quite a lot.

Anyway, any tips would be welcome.

Simple... I just turn off Microsoft Defender. Problem solved.
There are many ways to do it. Just google...
Other than that, I agree with @user1 that there is nothing that can be done.