Antivirus False positive in my executable

Question

I just ran into an annoying problem. Suddenly Avira AntiVir started to flag one executable from my software as being a virus.

As the default action from almost any user is to click OK and Avira suggests to put the virus in quarantine, most of my users are deleting this executable.

Well, let's not be arrogant and check if I'm not infected indeed. I posted the file to http://www.virustotal.com and from all anti virus only Avira flags it as infected. Furthermore I scanned my computer with two different anti viruses and it is clean.

I already posted a mail to my users explaining what is happening but this is an overhead to my support that I really don't want.

OK, the question is: Is there a way to avoid this kind of behavior? I can't think any way else than signing the files, (don't really know if it would solve) but let's see if you have any creative idea.

Answer 1

It is surprisingly common that Delphi applications are reported as (potentially) harmful by AV applications. It happened to me a while ago, using Delphi 2009, see http://en.wikipedia.org/wiki/Wikipedia:Reference_desk/Archives/Computing/2010_March_20#Delphi.2FAVG_Issue.

At SO, we also have

• Virus in Delphi 7
• Accidentally created a virus?

and many more.

It might be the actual Induc Virus. But most likely, it is a false positive.

Answer 2

Andreas's answer is excellent; it just happens a lot to Delphi applications.

Signing code doesn't make any difference -- I've had NOD32 throw false positives on signed Delphi code.

If there were any techniques that would avoid false-positives, virus authors will use them to avoid detection.

I've found the best course of action is, unfortunately, reactive rather than proactive. All AV vendors have a facility to report false positives, and I've found them to be responsive to reports.

Answer 3

There are several reasons why an Anti Virus product might trigger on a Delphi produced exe, a few common reasons are:

• Lots of viruses are written in Delphi and therefore your exe might have some code parts that look the same as existing viruses.
• The import table of your program is used to determine what your exe might do, for instance linking to Credentials Management or Disk Management functions triggers some AV's.

As suggested before try scanning your release version with online services such as Virustotal or Jotti and always report your false positives to vendors instead of trying to prevent being a false positive. My experience is that AV vendors react quite fast on submission.

Answer 4

Many honest developers have problems because of careless antivirus software. See this also: How to prevent false positive virus alarm on my software?

Imagine that for each false positive they show, you lose a possible customer. Programmers should take action against such antivirus products and force them to be more careful about false positive alarms, even to get some revenue back for the sales we lose because of them.

Update:
Recently I have observed that:

• Number of false positives on VirusTotal.com is MUCH higher when the program is compiled in 'Release mode' (with compiler optimizations) then when it is compiled in 'Debug mode'.
• Detection sky rockets when EurekaLog is used.

So, submit to VirusTotal before you publish your program!

---

Update 2019:
Unfortunately, InnoSetup is not spared also. I created a dummy installer with InnoSetup and upload it on VirusTotal. 5 out of 52 programs reported a false positive! Update on update: Now the number of false positive extended to 9!

Answer 5

As a solution, you may want to:

1 - Verify your Delphi compiler is not infected
2 - Verify your sources and libraries are not tempered with (that was the M.O. for the Induc Virus)
3 - Check your (guaranteed) clean exe with the AVs. If they report a false positive, contact them so they could fix their tests.

4 - If you need to distribute before there is a chance to correct the AVs, sign your exe, so that your users could verify it's clean.

Answer 6

In Free Pascal/Lazarus groups and bugtracker, such messages happen nearly every release and/or month.

We generally advise users to ignore all "generic" or "heuristic" scanning types, and stick to signature based scanning (as most corporate virusscanners do).

This because it is nearly always an heuristic alarms, never specific malware. This can be readily seen in the fact that the detected "virus/trojan" is nearly always of the "generic" type. Usually the virusscanners are also typical "home" virusscanners, or home editions of general virusscanners (Norton used to be particularly bad, nowadays it mostly the smaller scale "cheap" home use scanners)

However we communicate mostly with developers, and already have trouble getting this message across. I can imagine, when distributing to clueless end-users, this is a real difficult message to communicate.

Still, there is no other way.