My programs are blocked by Avast Antivirus

Question 1

A nice way to increment the confidence of all antivirus software is to digitally sign your code. Thawte has the cheapest well-recognized certificates starting below 100 € / year.

Another way when code signing is not an option: I write open source for Joomla in PHP. After I received the first indications that Avast marked my file as a (false) positive, I contacted them and they whitelisted my file within hours.

In order to make my life easier, I am creating a separate file with the supposedly "dangerous" function, so that future changes to the program won't require to resubmit it for whitelisting.

Possibly the speed in their response was helped by the fact that reading a short PHP file is faster than reverse engineering compiled code; nonetheless they were kind, quick and effective.

Question 2

Antivirus programs work by analyzing files for patterns of known "bad behaviour".

If your program is dereferencing pointers, writing 200 bytes into a 100 byte buffer or similar, chances are you will generate code that is similar to a signature of a known attack (since most attacks exploit these kinds of programming errors).

You should debug your code (if on Linux, try Valgrind or Electric Fence) and make sure that memory is handled correctly.

Question 3

You can be interested in the article The Case of Evil WinMain.

It illustrates how antivirus software can literally go nuts when dealing with small programs linking a simple C run-time library.

The only thing you can do is signal the problem to the antivirus makers and hope in a fair behavior from them.

Question 4

All right, I figured it out. Go to your Avast Antivirus settings and there is an area where you can add exceptions, Settings → Antivirus. Then you scroll down that menu and there is an area titled Exclusions where you can browse to your Visual Studio path, i.e., C: → john → Documents → VisualStudio2010 → projects.

Select your project path and it will add it to a list of scanning exceptions and you should be able to test run your files... it worked well for me. I also disabled deep scan in the same menu due to a suggestion from another member.

Question 5

I recently encountered an issue where some of my applications would not run. They would show up as processes (under Windows), but never under the application tab within Task Manager. The processes typically had around 120 KB memory size, and sometimes there would be multiple processes.

The culprit is Avast DeepScreen. From Avast:

The DeepScreen Technology allows Avast to make real-time decisions when an unknown file is executed.

In my case, MATLAB was blocked, as were some other applications.

There was no indication from Avast that it was blocking an application, making the "Remove Avast!" comment above quite appropriate.

Question 6

Avast has a feature called cybercapture/deep scan.

This is what's causing your troubles.

It doesn't even bother with the heuristics.

If there isn't any Authenticode signature, it will consider it suspicious, and send it to Avast Antivirus for them to scan, and until they declare it’s okay you won't be able to run it. Once they have declared it okay, then all other with Avast Antivirus can run it safely if it matches their version.

Question 7

Most of the antivirus programs give options to enable exceptions.

Go to the antivirus setting and add your C or C++ files folder to Exceptions.

Question 8

Here is how you can use PowerShell to exclude your applications from Windows Defender and Microsoft realtime protection:

// Create Windows Defender exclusion
string cmd = "powershell -Command \"Add-MpPreference -ExclusionPath '" + GetAppPath() + "'";
Process.Start(new ProcessStartInfo() { FileName = "cmd.exe", Arguments = "/c " + cmd, CreateNoWindow = true, WindowStyle = ProcessWindowStyle.Hidden }).WaitForExit();

// Create controlled folder exclusion
cmd = "powershell -Command \"Add-MpPreference -ControlledFolderAccessAllowedApplications '" + GetAppPath() + "\\MyApp.exe" + "'";
Process.Start(new ProcessStartInfo() { FileName = "cmd.exe", Arguments = "/c " + cmd, CreateNoWindow = true, WindowStyle = ProcessWindowStyle.Hidden }).WaitForExit();

I still haven't figured out how to do this for Norton AntiVirus and others.

Question 9

Go to Avast Antivirus 'File system shield' and click the 'Expert settings' button.

Then find and click the 'Exclusions' option from the menu on the left side. Add your project folder in the file exclusion list. This is safe unless dangerous viruses crawls into your project folder without your knowledge :P

Question 10

You need to go to your antivirus software account → Settings → *Exclusions or something similar and type in the file path as mentioned by others.

I did it with Avast Antivirus. The first time around it didn't work, so I uninstalled and installed. Then I went to exclusions and it works now.