Antivirus keeps detecting my project as a virus

Question

Good day, I am trying to create framework for my game to make coding easier for me. I just created function to add object, but after I created part where I create index buffers, anti-virus keeps telling me: "Virus found: Win32: Evo-gen [Susp]" and I don't know why. The code of function to load the object:

HRESULT Framework::AddObject(Object* obj){
    std::vector<short> indices;
    std::vector<VertexType> vertices;
    obj->GetData(indices,vertices);
    IDirect3DVertexBuffer9* cVBuffer;
    IDirect3DIndexBuffer9* cIBuffer;
    int at=vertexBuffers.size();
    vertexBuffers.push_back(cVBuffer);
    indexBuffers.push_back(cIBuffer);
    unsigned int sOfVerts=vertices.size()*sizeof VertexType;
    unsigned int sOfIndices=indices.size()*sizeof(short);
    vCount.push_back(vertices.size());
    iCount.push_back(indices.size());
    HRESULT hr=device->GetDevice()->CreateVertexBuffer(sOfVerts,0,D3DFVF_VertexType,D3DPOOL_DEFAULT,&vertexBuffers[at],NULL);
    if(FAILED(hr)){
        EndWithError("Failed to load object",hr);
        return hr;
    } else {
        void* p_vertices;
        hr=vertexBuffers[at]->Lock(0,sOfVerts,(void**)&p_vertices,0);
        if(FAILED(hr)){
            EndWithError("Failed to lock buffer",hr);
            return hr;
        } else {
            applog<<"Successfuly created VertexBuffer for object "<<obj->GetClass()<<"["<<at<<"], vertices size: "<<sOfVerts<<", vertices count: "<<vertices.size()<<std::endl;
            memcpy(p_vertices,&vertices[0],sOfVerts);
            vertexBuffers[at]->Unlock();
        }
    }
    hr=device->GetDevice()->CreateIndexBuffer(sOfIndices,D3DUSAGE_WRITEONLY,D3DFMT_INDEX16,D3DPOOL_MANAGED,&indexBuffers[at],NULL);
    if(FAILED(hr)){
        EndWithError("Failed to load indices",hr);
        return hr;
    } else {
        void* p_indices;
        hr=indexBuffers[at]->Lock(0,sOfIndices,(void**)&p_indices,0);
        if(FAILED(hr)){
            EndWithError("Failed to lock index buffer",hr);
            return hr;
        } else {
            memcpy(p_indices,&indices[0],sOfIndices);
            indexBuffers[at]->Unlock();            
        }
    }
    return S_OK;
}
//device->GetDevice() - returns IDirect3DDevice9*
//obj->GetData(vector<int>& indices,vector<VertexType>& vertices); //gets vertices and indices
//obj->GetClass() const; - returns name of class of object, because Object is base class for another objects

And Render function looks like this:

void Framework::RenderFrame(){
    IDirect3DDevice9* dev=device->GetDevice();
    if(dev!=NULL){
        dev->Clear(0,NULL,D3DCLEAR_TARGET,D3DCOLOR_XRGB(32,32,64),1.0f,0);
        if(SUCCEEDED(dev->BeginScene())){
            for(unsigned int i=0;i<vertexBuffers.size();i++){
                IDirect3DDevice9* dev=device->GetDevice();
                dev->SetStreamSource( 0, vertexBuffers[i], 0, sizeof( VertexType ) );
                dev->SetFVF( D3DFVF_VertexType );
                dev->SetIndices(indexBuffers[i]);
                //dev->DrawPrimitive( D3DPT_TRIANGLELIST, 0, 1 );
                dev->DrawIndexedPrimitive(D3DPT_TRIANGLELIST,0,0,vCount[i],0,iCount[i]/3);
            }
            dev->EndScene();
        }
        dev->Present(NULL,NULL,NULL,NULL);
    }
}

Can anyone tell me what is the reason, why anti-virus detects this as a virus and how to fix it?

Answer 1

Problem solved. And it had almost nothing to do with index buffers. The reason was because of 2 unclosed output file streams.

Anyway thanks to everyone! I atleast learned something new.

Answer 2

Antivirus software uses "heuristics" (fancy word for "advanced guesswork"!) to detect "bad patterns". This sounds like a "false positive".

The proper fix is to report the problem to your AV provider, and let them issue a new version of "detection" that doesn't falsely detect valid code. However, unless you have a very good AV provider, it's unlikely that you will see much from this within the next few weeks.

So, the ACTUAL solution is often to either remove the AV completely or replace it with a different product [which by the way, both of those can be quite tricky, as AV software tends to make itself hard to uninstall - for good reasons of course, you wouldn't want the first virus to hit your machine to uninstall your AV software - which means that sometimes the AV uninstall itself isn't uninstalling EVERYTHING it should].

Sometimes just turning off the "live scanning" is good enough.