How to make software not thought as virus by some antivirus software? - Page 1
Forum section: electronics / general

author: jmaja
author_rank: Frequent Contributor
timestamp: December 08, 2015, 11:00:22 am
content: I have run into problems recently with antivirus software. It removed a part of a software I use and a customer of mine just reported that his antivirus software has detected a "virus" in the software I have made.So how can a software developer make certain that his software is not removed by some antivirus software a customer is using?I checked my software with just updated antivirus software I have and it didn't find any viruses.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: December 08, 2015, 11:11:56 am
content: TBH all you can really do is report the false positive to the vendor of the antivirus software. How they respond will vary massively depending on the company in question and unfortunately what mood the person who picks up the ticket is in...If you use any sort of code encryption and/or polymorphism it won't help either. A lot of InfoSec people refuse to accept there are legitimate non malicious uses for such things.

author: Jeroen3
author_rank: Super Contributor
timestamp: December 08, 2015, 11:17:29 am
content: You can't. Just regularly check it on virustotal, and report it to the virus company.Some update so much without proper testing they have Windows system parts, or even parts of themselves, seen as virus. And all goes locked.But, there are a lot of APIs to use to make sure you are seen as virus, or at least as "generic Trojan" which basically is the antivirus telling: "I don't trust this, check for yourself" in a very complicated way.

author: continuo
author_rank: Frequent Contributor
timestamp: December 08, 2015, 11:37:08 am
content: Bribe them, so they put your virus on their whitelist

author: jmaja
author_rank: Frequent Contributor
timestamp: December 08, 2015, 11:52:56 am
content: I don't use any encryption. It is just a quite simple software that reads my sensor through USB, plots on the screen and saves the results to an ASCII file. I tried my software with virustotal and nothing was found. I'm still wating for an answer from my customer about which antivirus system he uses.I also tried the software I'm using and 2/54 marked it as a virus. I know the vendor has asked them to remove it from the virus list and this was a long time ago!

author: G7PSK
author_rank: Super Contributor
timestamp: December 08, 2015, 12:06:54 pm
content: Most anti virus allows you to white list a program on individual computers, you need to set the removal to ask me then when it flags the software you just tell it to trust it.

author: jmaja
author_rank: Frequent Contributor
timestamp: December 08, 2015, 12:28:39 pm
content: Quote from: G7PSK on December 08, 2015, 12:06:54 pmYes I did that on my computer for the software I use. But I really don't like that my customers need to do that for the sofware they have bought from my company.

author: G7PSK
author_rank: Super Contributor
timestamp: December 08, 2015, 01:14:47 pm
content: Most software is flagged by anti virus these days if its new even stuff from Microsoft if only a few users have downloaded it, seems that way until a few thousand are using the software. So for custom stuff, all you can do is advise the customer.

author: continuo
author_rank: Frequent Contributor
timestamp: December 08, 2015, 01:21:57 pm
content: If there was any way you could reliably stop virus scanners from flagging your code as suspicious, any virus developer would do that and no virus would ever be found...

author: Ian.M
author_rank: Super Contributor
timestamp: December 08, 2015, 01:29:35 pm
content: Submit all your fixed files to multi-engine online checkers every time you do a release build so that the AV companies see your files as early as possible. Put meaningful information in the properties metadata for all filetypes that support this so anyone examining the file can easily determine its part of your product and publish a SHA256 hash for your installer and also for all fixed content files in the installation folder so the user can determine whether or not they have been tampered with.You'll *STILL* get false positives but hopefully fewer.

author: Wilksey
author_rank: Super Contributor
timestamp: December 08, 2015, 03:57:48 pm
content: I have found, and this might not be true of all findings, but if I make a app in C++ (MINGW or MSVC++ compilers), I have a 50/50 chance of it being flagged, if I use Borland / Embacarado (or however you spell it) whether it be Delphi or C++ it has a 50/50 chance of being flagged, if I create something using assembler (using WinAPI) or C# it never gets flagged, I would have thought assembler would but I guess nobody writes viruses in assembler anymore!You haven't stated (or I haven't seen) what compiler you are using?

author: jmaja
author_rank: Frequent Contributor
timestamp: December 08, 2015, 04:15:15 pm
content: I use MINGW gcc and my code is pure C. I also use the GTK+ and FTDI libraries, which probably have some C++ internally.My customer had Panda antivirus, but when I run virustotal it included Panda and showed no viruses. Is this typical?

author: Jeroen3
author_rank: Super Contributor
timestamp: December 08, 2015, 05:01:32 pm
content: I think virustotal only compares against the database, and does not perform heuristic check, where an AI determines the risk level.Ask the customer what name it labeled your software. If this is "generic" is it the AV telling it doesn't know, but assumes. Remember an AV is a tool and does not set the rules, you do. (Or IT does)

author: dferyance
author_rank: Regular Contributor
timestamp: December 08, 2015, 06:42:48 pm
content: While AV software is hardly perfect, be careful that you don't assume it is a false positive too quickly. You might happen to have a virus on your build computer that infected your build output. Also, maybe you are using a 3rd party library that is infected.You might want to be sure you do code-signing. Not sure if it will help but it is a good idea in general. Maybe a virus already infected your customer and it injected itself into your program on their systems.

author: marshallh
author_rank: Unknown
timestamp: December 08, 2015, 10:23:06 pm
content: Upload to virusscan.jotti.orgDon't use UPX or other packers, that will get you flagged. Using certain API calls may also trigger some.