You *really* want to make sure you keep that turkey badge, don't you? 

By fair means or fowl!

I found this interesting. I recompiled a bunch of my ahk and AutoIt3 utilities without UPX compression.  I noticed the other day MalwareBytes anti-malware still flagged a bunch of them.  Seems like there may be something in the compile wrapper rather than in UPX.  Seems a bit odd.

edit: before anyone gets paranoid, I scanned the compiled exes in the script folders and none of them were flagged.  Seems it only wants to flag them in Windows7 32 bit.  Weird.

That does sound weird.

Did you happen to try sending various things to virustotal?

Nope.  What I think it is, when I get the false positives in Malwarebytes and it's just the AutoIt or ahk program, I add it to the ignore list.  I probably forgot that I already added them on the Vista machine earlier. When I did a full scan on the Windows7 machine it found the files without UPX compression so it probably disregarded the ignore list since they were so much bigger.  At least that's my theory.


Does make you wonder what it finds that triggers it off though.

This issue caused me to look into some of the pros/cons of UPX compression.  I can't seem to find the links right now.

f0dder wrote a nice article about (some of) the reasons why exe compression is bad:

http://f0dder.reteam.org/packandstuff.htm

You can add the never ending problems with false positives to that.

There are adjustments to zip compression - it supports a few different algorithms, and the most common one (deflate) can have compression characteristics adjusted; not much point in going for less than maximum compression on today's hardware, though . The .7z and .rar formats have fairly more decent algorithms, but they also have a huge advantage over .zip: solid compression, which matters a lot when your archive includes a lot of small files (typical for source code distribution).

There are adjustments to zip compression - it supports a few different algorithms, and the most common one (deflate) can have compression characteristics adjusted; not much point in going for less than maximum compression on today's hardware, though . The .7z and .rar formats have fairly more decent algorithms, but they also have a huge advantage over .zip: solid compression, which matters a lot when your archive includes a lot of small files (typical for source code distribution).

Maybe you can tell me which (free) zipper you are using? I looked at four and didn't see any "more thorough" setting for .zip format.  Only other formats.

Thanks for the feedback.  At the size of my stuff even a v90 dial-up it's only a few seconds difference on the download.  Plus some newbs may wonder why there's a .7z file inside their .zip file.  So it's not really worth messing with it at this point.  Zip may not be a the best but it's built into Windows. Pretty much guaranteed to be there even for the newbiest newbs.

edit: I did find out 7-zip command line implementation has a switch for more thorough .zip compression.  But at the size of my files, the archive is only about 1 or 2 KB smaller.  Guess I'll stick with 7-zip shell integrated version.  .7z does come out a bit smaller but "file not found" is about a fate comparable to death. Too much risk and not much reward trying to change links. If I was just starting now I'd probably go with .7z format though.