Antivirus False positive in my executable

Question

Hi,

I just ran into an annoying problem. Suddenly Avira AntiVir startet to flag one executable from my software as being a virus. As the default action from almost any user is to click OK and Avira suggests to put the "virus" in quarantaine, most of my users are deleting this executable. Well, let´s not be arrogant and check if I´m not infected indeed. I posted the file to http://www.virustotal.com and from all antivirus only Avira flags it as infected. Furthermore I scanned my computer with two different antivirus and it is clean. I already posted a mail to my users explaining what is happening but this is an overhead to my support that I really don´t want. OK, the question is: Is there a way to avoid this kind of behaviour? I can´t think any way else than signing the files, (don´t really know if it would solve) but let´s see if you have any creative idead.

Thanks.

Answer 1

It is surprisingly common that Delphi applications are reported as (potentially) harmful by AV applications. It happened to me a while ago, using Delphi 2009, see http://en.wikipedia.org/wiki/Wikipedia:Reference_desk/Archives/Computing/2010_March_20#Delphi.2FAVG_Issue.

At SO, we also have

• http://stackoverflow.com/questions/2006534/virus-in-delphi-7
• http://stackoverflow.com/questions/993671/accidentally-created-a-virus

and many more.

It might be the actual Induc Virus. But most likely, it is a false positive.

Answer 2

As a solution, you may want to:

1 - Verify your Delphi compiler is not infected
2 - Verify your sources and libraries are not tempered with (that was the M.O. for the Induc Virus)
3 - Check your (guaranteed) clean exe with the AVs. If they report a false positive, contact them so they could fix their tests.

4 - If you need to distribute before there is a chance to correct the AVs, sign your exe, so that your users could verify it's clean.

Answer 3

Andreas's answer is excellent; it just happens a lot to Delphi applications.

Signing code doesn't make any difference -- I've had NOD32 throw false positives on signed Delphi code.

If there were any techniques that would avoid false-positives, virus authors will use them to avoid detection.

I've found the best course of action is, unfortunately, reactive rather than proactive. All AV vendors have a facility to report false positives, and I've found them to be responsive to reports.

Answer 4

There are several reasons why an Anti Virus product might trigger on a Delphi produced exe, a few common reasons are:

• Lots of viruses are written in Delphi and therefore your exe might have some code parts that look the same as existing viruses.
• The import table of your program is used to determine what your exe might do, for instance linking to Credentials Management or Disk Management functions triggers some AV's.

As suggested before try scanning your release version with online services such as Virustotal or Jotti and always report your false positives to vendors instead of trying to prevent being a false positive. My experience is that AV vendors react quite fast on submission.

Answer 5

In Free Pascal/Lazarus groups and bugtracker, such messages happen nearly every release and/or month.

We generally advise users to ignore all "generic" or "heuristic" scanning types, and stick to signature based scanning (as most corporate virusscanners do).

This because it is nearly always an heuristic alarms, never specific malware. This can be readily seen in the fact that the detected "virus/trojan" is nearly always of the "generic" type. Usually the virusscanners are also typical "home" virusscanners, or home editions of general virusscanners (Norton used to be particularly bad, nowadays it mostly the smaller scale "cheap" home use scanners)

However we communicate mostly with developers, and already have trouble getting this message across. I can imagine, when distributing to clueless end-users, this is a real difficult message to communicate.

Still, there is no other way.

Answer 6

False positive :) Check

http://www.ginktage.com/2010/01/delphi-7-mcafee-and-virus/

I have described the problem and possible solution too .