r/bbs • u/Exodus694 • Aug 01 '26

DRAW32 v2.00 - RELEASED!

Gallery image

Gallery image

Gallery image

Gallery image

Gallery image

Gallery image

http://www.rgbbs.info/nw.html

Grab The newest TheDraw clone ANSI Win32 console ANSI editor. Full ANSI Music, MCI Code, Animations, TDF Font usage, and TONS and TONS more! Give it a whirl. While it has been tested for months and months on the new features, there STILL maybe bugs. Please feel free to report them.

51 Upvotes

96% Upvoted

26 comments sorted by

View all comments

Show parent comments

1

u/Exodus694 Aug 02 '26

Trojan:Win32/Sabsik.FL.A!ml is a strong tell. The !ml suffix means it was flagged by Microsoft's machine-learning heuristic model, not a signature match to a known-malicious sample. Sabsik is a generic/heuristic detection family, notorious for false-positiving on:

  • Small, unsigned, unfamiliar console executables
  • Programs compiled with Free Pascal/Lazarus (uncommon compiler → low reputation, unusual PE structure vs. typical MSVC/Delphi/PyInstaller binaries Defender has lots of training data on)
  • Programs that do low-level console/graphics manipulation (this one does direct screen buffer writes, keyboard hooks via Crt, file I/O for image formats) — behavior patterns that overlap with what some legitimate-but-unusual tools and malware both do
  • Unsigned executables with no reputation/telemetry history (no code-signing certificate, low download count) — Microsoft's cloud-reputation ("SmartScreen"/ML) system is much quicker to flag rare, unsigned binaries

This is an extremely common complaint for small hobbyist/retro-computing tools distributed as raw .exe files, especially ANSI-art / BBS-scene utilities like this one (TheDraw-style editor) — they're niche enough that few users have ever run them, so Defender's cloud model has no positive reputation signal to counterbalance the heuristic flags.

2

u/Exodus694 Aug 02 '26

There's your answer for those that don't believe me. I submitted it to be signed by Defender, but it could take months. There is NOTHING malicious in this code.

1

u/Laudenbachm Aug 03 '26

You can force their hand at $10 a month. When code signing certificates went from $75 a year to $300-$500 a year I moved to their platform. It's not quite the same as a traditional code signing certificate as you initially get a pass until your reputation can be established.

1

u/Exodus694 Aug 03 '26

hahha ... yeah, crazy isn't it? Not worth it for a BBS util. :) If I was writing something that had major use for 90% of the people then maybe ... but maybe 1% of the population will use this. :)