Best IT Recipes

Accidentally created a virus?

I saw that this happens quite often: I write an application in Delphi, and when I compile it, the virus scanner tells me that I created the virus and then immediately deletes the executable file. This is annoying, but reasonably easy to fix by performing a complete overhaul, first deleting the * .dcu files, and sometimes just waiting.

This happens with Delphi 6, 7, 2005 and 2007, as far as I know. And Symantec, Kaspersky, McAfee, and NOD32 were all guilty of reporting these false positives. I know this because Delphi adds timestamps to its DCU files, and these timestamps end in the final executable and, apparently, are part of some random virus signature.

I do not want to disable the virus scanner, not even for a single folder or file. And I'm not really for a solution, but I'm interested in the following:

  • Do other compilers have these false positives?
  • Does this also happen with .NET executables?
  • Do others also notice similar issues with Delphi?
+55
delphi antivirus false-positive virus
Jun 14 '09 at 20:21
source share
18 answers

Are there any false positives with other compilers?

Yes, it was a common problem in the past for AutoIt , as described in this forum post "Are my AutoIt EXE files really infected?" . In most cases, including AutoIt , this is due to bad heuristic practices. Because AutoIt uses the free and open UPX compressor, it is often mistaken for malicious code that also uses UPX .

The best (and possibly the only) thing you can do is to report these errors so that they can refine their heuristics or at least the whitelist of your application.

Below is a list of contact details for some popular antivirus companies. All of them claim to value performance as they help them improve their product.

It turns out there is a large list of AV software on Wikipedia called the 'List of antivirus programs . This is more complete than my list above.

Autoit forum member made a great script to send a fake message to a large list of AV providers to automate this process a bit.

+101
Jun 14 '09 at 20:57
source share

It sounds more like heuristic hype for me. Do you have heuristics turned on (some scanners may refer to it as a "virus code")? The chances of timestamps being equal to "parts of some virus signature" seem too small to happen all the time.

When I launched the antivirus scanner, I never saw this problem with D6 or D7.

+10
Jun 14 '09 at 20:30
source share

In fact, there is a Delphi virus, see http://www.sophos.com/blogs/sophoslabs/?p=6117

+8
Nov 15 '09 at 3:17
source share

Yes, my team experienced this, perhaps half a dozen every 2-3 years with Sophos in a corporate setting. So very rarely, but it happens.

Our IT nerd started demanding that I look through all the 1.5M lines of code in our application to “make him leave,” but he didn’t drag out this line too much ...

In fairness, it should be said that he was initially worried that our clients might also receive such a warning, but we only ever saw it when exe was created from the IDE on the developer's computer, never in exe exe release on the test window or in another place.

Personally, this happens so rarely that we don’t worry about it.

+6
Jun 14 '09 at 10:18
source share

This happened to me with deployed code. The next update for the scanner solved the problem. Some cretin wrote a virus using the same compiler, and the signature was part of the runtime library, and not in hostile code.

+4
Jun 14 '09 at 23:07
source share

This is not so rare when using non-standard compilers or when creating unusual low-level materials: I remember creating false positives when I was developing the OS: AntiVir did not like some of my flat binary files.

Recently, a message about such a problem has appeared on the tinyCC mailing list , which retains AVG.

+3
Jun 14 '09 at 20:32
source share

I have never seen this, having done most of the development in C ++ and .NET using Visual Studio (starting from version 1.5 to 2010).

+2
Jun 14 '09 at 20:28
source share

I have only seen this with assemblers. For example, MASM32 actually warns people that it can run anti-virus scanners, since EXEs are so small (and / or some viruses are written to be mounted). My McAfee scanner prevented some of the sample programs as viruses.

This should only happen for antivirus scanners that have a suspicious viewing mode.

+2
Jun 14 '09 at 20:29
source share

In some applications, if I use RtlVclOptimize.pas, Avira antivirus reports that I created a virus.

+2
Jun 15 '09 at 0:06
source share

plus what others say, modern antivirus programs increase the level of viruses if your programs also use some “suspicious” APIs (for example, URLdownloadFile or other API related bindings). if you use google delphi RAT FUD API undetectable, you will find many interesting topics.

+2
Jun 15 '09 at 4:09
source share

Some antivirus programs even designate a batch file as a virus and cannot be sure that it is not. It is rather annoying if this file is part of a third-party library, and a virus alert is triggered every time TortoiseSVN checks it. I ended up disabling the antivirus scanner, deleting the file and committing. (Without turning off the scanner, I could not even do this :-()

+1
Jun 15 '09 at 5:32
source share

A few years ago, every time we updated GNU Linker from mingw sources and started distributing it with our compiler, we received several reports that vivusscanners classified ld.exe as a virus. (.exes writing.exes ...)

+1
Jun 15 '09 at 7:33
source share

I would not call it “false positive” because, strictly speaking, this is not true, and antivirus software is by no means “guilty”.

I am 99% sure that this is a heuristic analysis, valid (I am sure it detects your executable file as something like win32.virus.generic strings - note the general, this is a sign that this is not his db signature, but rather was detected heuristic), and being a heuristic and all, it does not give you any guarantee that everything that it finds is malicious, it just tells you that the executable is suspicious from its point of view.

The easiest solution for this is to simply add an exception for your file by name (it is always the same name, right?). If you are not comfortable, you should probably create your own antivirus software before taking action so that you can skip the file manually.

In general, I found that coding in windows with antivirus software is somewhat annoying (don't do this a lot these days, but still), especially if the specified software is in "paranoid mode." Annoying, although it is inevitable (IMO).

+1
Jun 15 '09 at 7:46
source share

It happened to me. The hook keyboard will run almost any heuristic software for scanning AV messages to record a key registrar. There are probably many other system calls that will also make it. Decision. Try reconfiguring your code or contacting the AV manufacturer to include your software in the exclusion list.

+1
Jun 16 '09 at 11:56
source share

I remember another weird one:

File marked as suspicious. The only thing the file was .OBJ! The .EXE file containing the code contained in the .OBJ was not considered a problem.

+1
Sep 09 '09 at 2:01
source share

If you have problems with false positives, there is a VirusTotal online service that will help you check your file against the number of anti-virus engines.
This is a free service, and currently it can run antivirus scans with almost 40 antivirus engines.

+1
Jul 27 '10 at 10:41
source share

Many honest developers have problems due to sloppy antivirus software. See also: How to prevent false positive virus alarms on my software?

Imagine that for every false positive they show, you are losing a potential customer. Perhaps we can team up against such antivirus products and make them more careful about false positive alerts, even to get some revenue for the sales we lose because of them.

0
Nov 21 '10 at 12:14
source share

VS Platform toolset 2010 displays my simple program as a virus. Changing the tools on VS 2013 solves it.

It simply creates an HttpWebRequest and writes the result to a file.

0
May 20 '16 at 7:00 a.m.
source share


More articles:


All Articles