How accurate are scan dates
How accurate are your pregnancy due dates?
Throughout my pregnancy, I've received two different due dates — one came from my very first ultrasound, when my baby was barely the size of a blueberry, the date that was then subsequently stamped on my record as "the" due date.
But then there was a second date, the one that showed up on my next couple of ultrasound scans. This date was a few days earlier. It's also the date that I prefer, not only because I'm now 38 weeks pregnant and ready to get this baby out, but because it matched the date I'd calculated on my own using information I looked up.
But ... which one should I believe? And how much does it really matter? After all, as many moms know, due dates are just educated guesses.
How are due dates calculated?
Traditionally, estimated due dates are calculated by taking the start date of a woman's last menstrual period and adding a year, subtracting three months and adding seven days, a method known as Naegele's rule.
"If you're a woman whose period is like clockwork, it's pretty accurate," Dr. Tamika Auguste, MD, an OB-GYN at MedStar Washington Hospital Center in Washington, D.C., told TODAY Health.
But that method doesn't account for irregularities in a woman's menstrual cycle — if she has a longer or shorter cycle than 28 days or any variability with ovulation, for example. That's why the American College of Obstetricians and Gynecologists recommends doctors use ultrasound measurement in the first trimester to establish an estimated due date.
The most accurate way to date a pregnancy is with an ultrasound done between 6 weeks and 8 weeks, 6 days, according to Dr. Michael Cackovic, MD, an OB-GYN with The Ohio State University Wexner Medical Center.
"The reason why is there's very little variation that can be detected in a measurement from that time," he said. "Pretty much all pregnancies are equal at that stage."
As a woman's pregnancy progresses, fetuses develop at different rates, which is why an estimated due date from an ultrasound measurement during the second trimester is less accurate. (And why I probably shouldn't be taking my second "due date" very seriously.)
As much as technology has improved, this is all still an imperfect science.
"Often we get a due date based on the last menstrual period and then do a sonogram and there's a discrepancy we have to address," Auguste added. "If it's all within a week, it's consistent. Once you go past about five or six days, then you have to start considering that your dates really may be off."
How reliable is my due date?
Even once your doctor has established a due date, there's no guarantee that your baby will come that day. In fact, only 6% of women deliver on their due date, Cackovic said.
I tell patients that really, your due date is a date in the middle of almost a month-long period of time that you could have your baby.
Dr. Michael Cackovic
"The reality is that about 70% of women will have their baby within 10 days of their due date," he said. "I tell patients that really, your due date is a date in the middle of almost a month-long period of time that you could have your baby. "
Nearly 10% of babies in the U.S. were born before 37 weeks of gestation in 2017, according to data from the Centers for Disease Control and Prevention, while 26% were born between 37 and 38 weeks and 57% were born at full term between 39 and 40 weeks. Some babies arrived after the due date, too: another 6% of babies were born in week 41 and less than 1% at 42 weeks.
Are there signs my baby will come early ... or late?
There are many signs that labor is coming: The cervix softens, a woman may feel that her baby has "dropped" lower in the pelvis or she may experience what's known as "bloody show," discharge that contains mucus and blood.
While these are all signs labor will happen — eventually — there's just no way to know when, exactly.
"The bottom line is we just don't know what starts labor," Cackovic said. "People ask me this all the time. The reality is that it's some complex mechanism between the baby's brain, the mom's brain and the placenta and we haven't figured it out yet. "
There are some rules of thumb that OB-GYNs follow, though.
"Women who have had multiple babies typically deliver earlier with each subsequent pregnancy," said Dr. Shannon Clark, MD, a professor of maternal-fetal medicine at the University of Texas Medical Branch at Galveston and the founder of BabiesAfter35.com. "First-time moms typically go to their due date in an otherwise uncomplicated pregnancy."
What about routine cervical checks?
Around week 36 or 37 of a woman's pregnancy, some doctors will begin to offer cervical checks at appointments, to see if a woman's cervix has started to dilate (open up) and efface (thin out).
"First-time moms typically efface first, and women who have had more than one delivery typically dilate first," Clark said. "Unfortunately, this does not really tell us when she will go into labor. What we as providers are looking for is some change in the cervix, whether in dilation or effacement, so we will know things are progressing in the right direction. "
Some doctors may not recommend routine checks, and some women may choose to opt out of them, because while it can be tempting to have the information, being dilated or effaced doesn't tell exactly when the baby's going to come.
"I don't check anybody's cervix unless they ask me to, or if they're contracting," Cackovic said. "Medically, there's just no reason to do it."
While there's no shortage of tips to kick-start labor available on the internet, Auguste stressed that it's important to talk to a doctor about the signs of labor before trying any natural induction methods.
"A lot of the information out there is old wive's tales or hearsay, so you really need to have that conversation with your provider," she said.
Wrong due date from ultrasound scan - why it happens
Listening to MFM mums, it's clear lots of you leave your scan with a nagging feeling that what you've been told that day doesn’t seem quite right. Perhaps you’ve been given a due date that seems totally out of sync with the date that you thought you were going to have your baby.
Despite the fact that sonographers are experts in their field, estimated due dates (EDD) calculated from pregnancy scans can be incorrect, as Ollysmum76 discovered.
“My due date got put back by 2 weeks at the 12 week scan. Original date given was 18 December but at the scan it was moved to 31 Dec. It just doesn't quite add up by my reckoning of when I think I ovulated and when I know we did the deed!”
"I had an early scan at 8 weeks, which put me back a week," adds AbnormalKitty. "Then at my 12 week scan, they put me forward by 4 days."
When do you normally have a dating scan?
Unless you have an early pregnancy scan most of you will be given your estimated due date at the 12-week scan. It’s at this time that you will be told how many weeks pregnant you are.
Of course you have probably already used an online due date calculator. This is where you discover that your due date isn't based on the date you conceived, it's actually calculated from when your last menstrual period started (your LMP). Weird huh? It's because it gives a definite date for health professionals to work with. There would be so many variables if it was calculated from when you think you conceived, especially as everyone's cycles are different and the fact that you don't necessarily conceive on the day you have sex!
- Try the MFM due date calculator
Pregnancy normally lasts from 37 weeks to 42 weeks from the first day of your last period, explains NHS Choices. But this will only give you a rough idea. This is especially true if you have an irregular cycle or have been on the Pill for example.
“Scans are an accurate way to give you a due date,” confirms Nigel from the Society and College of Radiographers. “If the scan date differs from your LMP dates, then the scan dates will be used, but do discuss with your midwife if you are concerned. The best time to establish this date is at the scan you are offered between 11 weeks and 2 days and 14 weeks plus 1 day,”
More like this
Just how accurate (or not) can the dating scan be?
Experts say that the scan date can sometimes come out as less pregnant than suggested by your LMP. This was the case for HowieMumma.
“My 1st scan with this baby put me 1 week earlier than I thought I was. But then again with my first baby I was spot on with dates, he always measured big and he was a week overdue... these babies like to be tricky! Babies are ready when they're ready - try not to worry (easier said than done).”
But Nigel also says that the estimated (and that is all it is) date is normally accurate plus or minus about a week.
“The due date is estimated by measuring the ‘crown rump length’ of your baby which is essentially their length from head to bottom. The healthcare professionals will stick to this date as far as possible because it is then used as the baseline for growth throughout pregnancy."
So can my due date change during my pregnancy?While the professionals like to try and stick with the date that you’re given at your dating scan, it can and does change.
This was certainly LH86's experience. “Trust me your due date might change. Your baby's growth can slow down and then have spurts.
"I'm 16+5 and have already been given 3 due dates and its changed for a 4th time back to the 2nd estimated due date! I've not even had my 20 week scan yet. I have scans every few weeks so it will probably keep on changing. My baby will come when it's ready anyway, maybe weeks before or maybe weeks after my due date."
What about early scans?Like MFMer LH86 above, some of these first EDD are derived from early pregnancy scans (pic above). These can be carried out from week 5 or 6 of pregnancy, which is a notoriously tricky time to be accurate on dates. Understandably, when it is such early days it’s easy to worry when the scan dates are different to what you were expecting.
As Loobylou77 explains, it's really common for these to change when it comes to the dating scan at around 12 weeks.
“I was measured at 6+6 (6 weeks and 6 days) when I should have been 8 weeks. Measurements at such an early stage aren't accurate which is why they wait for 12 weeks to date you.
"At my 12 week scan I was back to bang on dates for my last period and was told to ignore the previous two scans, which they said were to check for 'viability' as opposed to dates. I know it’s hard, but please try not to worry.”
AdamsMum also found the date that she was given at an early dating scan was changed when she got to her dating scan.
“All the dates I was given were wrong up until my 12 week scan - which gave my EDD as one day before the date I had calculated myself!”
Expert Jan Steward, who is director of Ultrasound Direct and Babybond, agrees that early scans carry a much greater risk of inaccuracy. “At our clinics we scan from 7 weeks but at this time due dates are not totally accurate as it is very early stages. We always recommend mums get a definitive dating scan closer to 12 weeks as this will be much more accurate.”
WoW babies confirms that it’s worth the wait for the 12 week scan.
“Definitely agree that dates from early scans are not accurate. Just half a millimetre at such an early stage can change your date by a week. Your 12-week scan will be far more accurate.
"I fell over at ‘7’ weeks by my last menstrual period (EDD 18 March) and was sent for an early scan. The sonographer then said that I was only about 4.5 weeks [EDD 2 April]. Then at the 12-week scan I got an EDD of 15 march, so that early scan was completely out.
"From then on he was smack bang on average size for babies EDD on 15 March. I wouldn’t take an early scan as read, as it’s not your official dating scan anyway.”
Does it get more accurate as you get more pregnant?Well, you'd think so, wouldn't you. And yet, bizarrely, after your dating scan at 12 weeks, your due date can get less accurate the more pregnant you get.
Sonographer Jan Steward explains, “As your baby gets bigger all of the usual differentials start to happen between big and small babies so it’s much harder to be accurate. At around 12 weeks you can get more accurate measurements. ”
What can you do if you believe your scan dates are wrong?“If your dates are wildly out then it may mean there is an issue with your baby’s growth so you should certainly talk to your midwife or doctor,” says Jan Steward.
“You will be offered another scan if the sonographer feels there is an issue. By talking to the health care professionals you should get a clearer picture as to what is happening.”
Read more...
- Can your pregnancy scan get your baby's sex wrong?
- What does the size of your bump mean?
- All you need to know about 3D and 4D scans
8 ways to find out the date of publication of an article on the Internet if there is no date on the page
How to quickly and easily see the date of publication of a material if the author has hidden it on the page. And do I need to display the date on my posts at all?
When preparing an article for the site, we advise you to study the top results in order to understand what materials the search engine likes for the queries you need. This way you can make a list of the characteristics of a successful material: the approximate number of characters, the preferred presentation format, peek at a good structure, heading template, and other characteristics.
When collecting material for a future article, you have to check the relevance of the information. If there is a number on the page, then everything is simple:
The date and time when the material was postedOf course, an unscrupulous webmaster could simply update the date and leave the information outdated. But if there is a fresh date, it is still more likely that the content has been updated.
Some sites intentionally hide the publication date, and there may be reasons for this.
Whether to display the publication date of article
It all depends on the content you post and the behavior of your audience.
If users are looking for a guide for an online service, it is important for them that the guide contains a new interface and all relevant functions. If they google the concert schedule, then in most cases they are interested in upcoming events, not past ones. The date in the issue can be a decisive factor when choosing a line where to click.
Recipes, basic knowledge and tips can be relevant for many years. If users do not care about the date, they will click on the SERPs regardless of the time of publication. But if the result has an old date, it can push away from the material, even if it is relevant.
ShoutMeLoud blogger has been posting articles since 2008, all with real publication dates. He conducted an experiment: he turned off the dates for all posts - clicks increased and traffic increased. I returned the dates back - I lost positions for about 100 keys and 40% of traffic. I removed the dates again - traffic and positions increased again.
In this case, it is best to either leave the date blank, or update the content regularly and set the date of the last update. But if you do not change anything in the text, but simply update the date or repost the material, this will be a violation of Google's rules.
It may work differently for you, we advise you to experiment:
-
Remove or put publication dates.
-
Measure how traffic has changed.
-
Return everything as it was.
-
See how traffic has changed now.
If dates are clearly better, then you should display them in posts.
How to give the search engine the right signal about the date of publication
Google may not show the creation date of the material in the search results if it considers that it is not important. He determines it by a complex of signals.
How to correctly indicate the date of creation and update of a web document:
-
Explicitly indicate the date on the page.
-
Use Schema.org microdata: for the first publication - datePublished, for subsequent updates - dateModified. The date format is ISO 8601.
-
The specified date on the page must match the date in the microdata. Time zones too.
-
If you have heavily reworked the content, you can update the visible date. Optionally display both the creation date of the page and the date the content was updated.
-
Use the current year in the text. If there are many other dates, this can mislead the search engine.
How to quickly see the hidden publication date of the material
We have collected eight ways to do this - manually or using services.
1. View in URL
Sometimes the address of an article includes the date of publication, although it is not indicated on the page. It's rare, but it does occur.
Alternatively, the URL can display a post serial number that can be compared with new ones. If the number you are looking for is 435, and the new one is 1327, you can figure out how old it is.
Post number in URL2. Scroll to comments
Commenting plugins often display the date they were written. From them you can understand the approximate date of creation of the material itself.
Day and time when the comment was writtenIf the article was updated, in some cases this can be tracked by the comments. For example, old comments dated back to 2015, and then began to appear in 2021. Apparently, the material was updated, raised in the blog and new commentators saw it.
3. Find manually in the source code
The creation and modification date is displayed in the code. In Google Chrome, press the hotkey Ctrl + U to open the page code, and use the Ctrl + F search to find the publication date by the word Published or the modification date by Modified.
Date search4. Use operators in Google search results
If the page publication date is not displayed in the search results, it can be forced. For example, here is a snippet without a date:
How to do it:
The date is not specified in the issueIn the search line, write the operator inurl: and add the URL of the desired page without spaces:
inurl:https://skidka02.ru/raznoe/kak-v-gugl-pochte-izmenit-podpis-kak- dobavit-podpis-v-gmail-poshagovaya-i...
Press Enter.
Adding an operatorThe date did not appear, the last step is needed. Add &as_qdr=y15 to the very end of the address bar (not the search bar) and press Enter. The date will appear.
The dateappeared in the snippet 5. Enter the URL into the Carbon Dating The Web service
Carbon Dating The Web searches the code of the page for mention of its creation. To see the result, you only need to enter the URL of the page in the field. A quick one-click method, but not very accurate.
For example, let's enter a link to an article about the length of the SEO text created on February 21, 2019. The service determined the creation date as February 22, 2019.
Estimated date of page creation her creation. Let's enter a link to our article with an overview of research on how users read articles. We posted it in 2018, and in 2021 we updated the content and updated the date. The service shows 08/15/2020 - the date of the intermediate update of the material.Estimated date of creation of the article
6. Find the date in the image address
Can work if there are images in the text of the post. For example, let's look at this material:
There is no date in the issue The date is also not indicated on the page and in the URLBut if you open any illustration in a new tab, the date when it was downloaded is visible in the URL of the image.
Date in the link to the pictureIt is very likely that this date coincides with the publication of the article. But the method will work only if the URL of the images is formed according to such a template with a date.
7. View in the Yandex.XML service
If you use the Yandex.XML service, you can view the day when Yandex visited the specified page for the first time.
To do this, in the "& query =" field, write "url:site.com/page".
The date will appear in the < modtime > tag, you can find it by searching the page. Pay attention to the format - first the year, then the day and month.
Date lookup8. View archive The Wayback Machine
The Wayback Machine is a digital library of websites, an initiative of the non-profit organization Internet Archive.
If you enter a page URL in the field, the archive will show the dates it crawled that page. Not the date of publication or update, but the date of scanning, so it will not work to determine the day when the article was posted.
But the first date of the scan will help to orientate the age of the material: if the archive visited the page five years ago, then it probably already existed.
Scanning material archiveMore useful: how to evaluate someone else's article to make it better
When an author is looking for information to create his material, he not only checks the dates so as not to take outdated ones, but also analyzes competitors' articles. This will help you understand how to make the material at the same level and even better.
This is where the free Content Analysis service comes in handy: enter the URL of a competitor's article or your own published material. The service will calculate the length, show meta tags, evaluate the optimization of the article, and calculate relevance to queries.
Relevance score in the serviceIt will also measure the download speed, analyze the main characteristics of the page, including micro-markup, image compression, links, canonical URL and more.
Page Options Which method do you prefer to use? Maybe there is something else that we have not analyzed in the material? Add in the comments!
About the features of scanning executable files by antiviruses and trusting the results of VirusTotal / Sudo Null IT News
Hello everyone. Below there will be a lot of stupid text, nostalgic memories and school code. In addition, the effectiveness of the VirusTotal service, as well as anti-virus engines in relation to executable files, will be considered.
Part 1. Delusional-nostalgic introduction
A lot has changed in my life. I became interested (in some places even to sleep deprivation) in my current work, in my region the war has been going on for the fourth year, a lot has changed and rethought in my personal life.
Many views and opinions have changed.
About 15-20 years ago, I was interested in the topic of hacking and writing malicious code, then my interests changed to the exact opposite - protection from this case, and then I realized that money and personal interests rule everything, and not at all altruism and the desire to help.
But that's it. In any case, IT turned out to be a part of even my present job, although it does not belong to the original specialization at all.
About 10 years ago, I wrote in a very narrow circle about the possibility of removing antivirus detection using self-extracting archives. Then it was, it seems, on Virusinfo, then someone reposted it under their nickname on DrWeb - so to speak, without copyrights and with their own authorship, then there was even a scandal - but that was also not true for a long time.
And recently I remembered the old. Much has passed, many things have been updated, and it turned out to be difficult to keep up with progress without stewing in the subject.
But the essence remains the same: sensations, money and personal interests. And playing on ignorance - which sometimes reach the point that Meltdown / Specter vulnerabilities are looked for in TVs and on-board computers of cars)))
But enough of this uninteresting nonsense. So, I decided to remember the old, and since I didn’t remember much, I decided to remove the detections from several viruses in the old fashioned way.
We will need:
- Knowledge of Windows command bat-scripts at the level of a student.
- Quick Batch File Compiler (hereinafter referred to as QBC)
- 7za.exe from package 7z1800-extra.7z (hereinafter referred to as 7Z)
- upx.exe from the upx394w.zip package (hereinafter referred to as UPX)
- file eicar.com, you can download, for example, here (hereinafter referred to as Eicar)
- The most basic computer with Internet access on any Windows operating system
Part 2. Just a little bit of theory
In order to move on, let's figure out what we're talking about. At the moment, as, indeed, before, the topic of antiviruses is being actively promoted. Say, antiviruses help prevent the loss of important data, antiviruses save from vulnerabilities, antiviruses do this, antiviruses do that, and so on.
At the same time, an ordinary user often does not even understand that an antivirus is not just a scanner, it is both a resident protection and a heuristic, and often also a proactive defense, a firewall and a sandbox.
We can dedicate not only an article to a book to each of these components, but we will focus on the most basic one: the scanner.
This component will not prevent connections to malicious sites, it will not catch malicious code on the fly, but it will allow you to check the file and give an answer: it is worth keeping it or it is better to delete it immediately and permanently.
Below we will test different antivirus engines and see how well they do this task.
Separately, I would like to note the VirusTotal resource - it allows you not only to check the file with various antivirus engines, but also represents a kind of sandbox for testing malicious (and generally any) code. Plus platform - free, minus - all samples that are sent to VirusTotal are subsequently transferred to all antivirus laboratories.
It is for this reason that below I will not give links to pages with scan results, but will provide screenshots with these results obtained during the work. Obviously (and I want to believe it!) After this article, the results will improve.
Authors of malicious code very often use packers and protectors that not only compress a malicious file, but also make it difficult to detect it by signatures, as well as its subsequent analysis. When using stolen protector licenses such as WinLicense and Themida, usually anti-virus laboratories do not bother to unpack themselves, but simply add protector signatures with a stolen key to the detection (famous detections like Trojan:W32/Black.A). This leads to false positives — similar stolen licenses are used by the authors of key generators, patchers, and some programs that are essentially not malicious, but are nevertheless protected from reversing.
Since everything described in this article will be provided to the reader for review below, I did not work with real malicious code (although I will provide its scan results below), but used the Eicar file, which is popular when testing antiviruses: this is a kind of stub, on which any antivirus should give stable detection.
So let's get started.
Part 3. Practice
So how Eicar is now detected on VirusTotal
To be honest, what I saw surprised me a little, because two anti-virus engines - Comodo and Malwarebytes for some reason decided not to follow common standards and ignore the detection. Nevertheless, the result is obvious - the file has a detection close to 100%.
As we agreed at the very beginning, we are a complete schoolboy, and therefore we will not invent our own packaging methods, but simply pack the file into an archive using 7Z:
7za a eicar.7z eicar.com
Check the received file for VirusTotal
Yes, there are fewer detections, since not all antivirus engines include the 7Z archive unpacker (well, or this setting is not included in VirusTotal by default) - but the detection rate is still high.
We complicate the task: we pack the file into an archive with a password. Let the password be fun:
7za a -mhe=on -pfun eicar-fun.7z eicar.com
The result of the check is obvious
The file is clean, because even with the unpacking procedure, the antivirus does not know the password for the file.
Detection removed - but we did not receive the executable file.
In real packers, the solution is quite complex and we will not go into these details. Let's use QBC services and write a simple script:
7za e -pfun eicar-fun.7z start eicar.com
The script simply unpacks the archive and runs the resulting file. QBC allows not only to generate the simplest executable file based on this script, but also to include the necessary things (7za.exe and the eicar-fun.7z archive) in this file, which can be accessed through the %myfiles% variable.
The resulting executable file can be without opening a terminal window (the so-called "Ghost"), and this is exactly what we need:
The final code looks like this: 7za e-pfun eicar-fun.7z start eicar.com
After compilation, the resulting file dumb_bat.exe unpacks Eicar and runs it.
We look at the result of checking this file on VirusTotal
It's funny, the detection decreased from 60 for an uncompressed file and 41 for an archive to 17 - at the same time, none of the anti-virus engines detected Eicar, the detections are clearly heuristic in nature, and in some cases resemble a false positive (DrWeb, Baidu, etc.)
Let's go further - add protection from execution in the test environment to our script - the simplest check that the file is executed in the real system. To do this, start unpacking only if the system has drive D and it has at least one file:
cd %myfiles% if exist d:/* (7za e -pfun eicar-fun. 7z) start eicar.com
Looking at detections
Particular attention is paid to at the bottom of the table, I singled it out separately, because everything did not fit into one picture:
So, checking disk D “broke off” the detections of the Chinese, Russians and Ukrainians: Baidu, DrWeb, Zillya. At the same time, these engines, like a number of others, were stopped due to a timeout (!)
In fairness, it should be noted that the restart still brought the scan to the end
However, in this case, the experiment cannot be considered “clean”, since a significant amount of time has passed since the first test.
This situation seemed curious to me - and I changed the line in the code to the following:
... if not exist d:/* (7za e -pfun eicar-fun.7z) ...
The result of the check is impressive
However, again, the second scan still took place.
There is a difference in the heuristics of a number of antiviruses (AegisLab and Baidu for some reason did not find anything in the second case), and there is also a problem in scanning in the case of checking for the presence of drive D. However, this may be a coincidence, although during the entire study I did not I have never seen a “blank” of so many engines at once.
Let's move on - add some interactivity to our file, which will definitely not be in any test environment. Let's change the script - make it a full-fledged console (not "Ghost"), and also add the pause command:
@cd %myfiles% @pause @if exist d:/* (7za e -pfun eicar-fun.7z) > nul @starteicar.com
Here's what the result of executing such a file looks like:
I don't want to slander users, but it seems to me that almost everyone will press a key in this case :) In any case, we have a simple example that can be wrapped in a much brighter wrapper social engineering.
Detection of such file
6 detections out of 67. Six, Carl! All are heuristic. And most likely, an unsuspecting user will consider the file safe.
I got an interesting result after compressing the final file using UPX with the command:
upx --best --ultra-brute --8086 --backup --compress-icons=3 dumb_bat3.exe of our very first code - which was without any checks at all, then Antiy-AVL 9 fell off on detections0220
For the latest version, the file has decreased, the essence has not changed, but the detections have increased
The detectives were added by the Chinese, but the Ukrainian Zillya successfully failed the test.
Part 4. Conclusions
Is it possible without them? ;) OK.
Of course, what is described above is primitive, simple, and in life everything is not so. If only because, in reality, the execution of our file will first cause proactivation triggers, and then it will be blocked by the resident module, which will see the resulting Eicar file.
But that's not the point.
The fact is that modern anti-virus scanners have remained the junk they were a dozen or two years ago, absolutely yielding to the simplest types of code packaging. Solutions in the form of test environments - "sandboxes", heuristic analyzers, etc. only added confusion, false positives, but in fact do not protect against a real threat. With the old, open and chewed to the giblets UPX, as there was a mess, so it remained. But I could well pack not a file that causes malicious activity, but the code itself, work not with files on disk in %temp%, but in memory, use not freely available utilities, but my own or closed developments - and thus bypass the triggering of a resident protection. I could well add interesting interface elements or copy one from a common program - and bypass the proactive user from an inexperienced user who will simply agree to any requests, trusting what he launched.