Accidentally created a virus?

Question

I've seen it happen reasonably often: I write an application in Delphi and when I compile it, the virus-scanner tells me that I've created a virus and then immediately deletes the executable again. It's annoying but reasonable easy to fix by doing a full rebuild, deleting the *.dcu files first and sometimes by simply waiting.

It happens with Delphi 6, 7, 2005 and 2007, as far as I know. And Symantec, Kaspersky, McAfee and NOD32 have all been guilty of reporting these false positives. I know it's because Delphi adds timestamps to its DCU files and these timestamps end up in the final executable and apparently appear to be part of some random virus signature.

I don't want to disable the virus-scanner, not even for a single folder or file. And I'm not really for a solution, but am wondering about the following:

• Do these false positives also occur with other compilers?
• Does it also happen with .NET executables?
• Do others also notice similar problems with Delphi?

Answer 1

I've never seen this, having done lots of C++ and .NET development with Visual Studio (from version 1.5 to 2010).

Answer 2

I've only seen this happen with assemblers. For example, MASM32 actually warns people that it might trigger virus scanners since the EXEs are so small (and/or some viruses are written in assembly). My McAfee scanner flagged some of the example programs as viruses.

This should only happen for virus scanners that have a "looks suspicious" analysis mode.

Answer 3

Sounds more like a heuristic screw-up to me. Do you have heuristics turned on (some scanners may refer to it as "virus-like code")? The chances that time stamps would equate to "a portion of some virus signature" seems too small to be happening all the time.

When I used to run a virus scanner, I never saw this problem with D6 or D7.

Answer 4

This is not that uncommon when using non-standard compilers or when doing fancy low-level stuff: I remember creating false positives when I dabbled in OS-development: AntiVir didn't like some of my flat binaries.

Recently, there's been a post about such a problem at the tinyCC mailing list regading AVG.

Answer 5

Do these false positives also occur with other compilers?

Yes, this is has been a common problem in the past for AutoIt as addressed in this forum post "Are my AutoIt EXEs really infected?". In most cases including AutoIt it stems from poor heuristic practices. Since AutoIt uses the free and open UPX compressor it is often mistaken for malicious code that also uses UPX.

The best (and possibly only) thing you can do is report these mistakes so they can refine their heuristics or at least white list you app.

Below is a list of contact information for some popular anti-virus companies. They all claim to appreciate submissions as it helps them make their product better.

• AntiVir - Contact
• A2 (A-Squared) - Contact (email address)
• Avast! - Contact
• AVG - Contact
• BitDefender - Contact
• BullGuard - Contact
• ClamAV - Contact
• ClamWin - Contact
• Comodo - Contact
• ESET's Nod32 - Contact
• eSafe - Contact (login required)
• Fortinet - Contact
• F-PROT - Contact
• F-Secure - Contact
• G-Data - Contact
• Kaspersky - Contact
• McAfee - Contact (email address)
• Norman - Contact (email address)
• Panda Anti-Virus - Contact
• Sophos - Contact
• Symantec (Norton) - Contact
• Vipre - Contact
• Windows Live OneCare - Contact
• ZoneLabs - Contact

Turns out there is a great list of AV software at on wikipedia called 'List of antivirus software'. It is more complete then my list above.

Answer 6

Yes, my team has experienced this maybe half a dozen times in 2-3 years with Sophos in a corporate environment. So, very rarely, but it does happen.

Our IT cretin started off demanding I review all the 1.5M lines of code in our app to "make it go away", but he didn't get too far pursuing that line...

To be fair, he was initially concerned that our clients might also receive such a warning, but we've only ever seen it triggered when building an exe from the IDE on a developer's PC, never on a release build exe on a test box or elsewhere.

Personally, it happens so rarely we don't worry about it.

Answer 7

I've had it happen to me with deployed code. The next update to the scanner solved the problem. Some cretin wrote a virus using the same compiler and the signature was part of the runtime library, not actually in the hostile code.

Answer 8

In some apps, if I use RtlVclOptimize.pas, the Avira antivirus tell that I have created a virus.

Answer 9

plus to what others'v said, modern anti-virus programs rise virus-alert if your programs uses some "suspicious" APIs too ( like URLdownloadFile or other API hooking related ones). if you google "delphi RAT FUD API undetectable" you'll find many interesting topics .

Answer 10

Some antivirus programs even flag a batch file as a virus and can't be convinced that it isn't. Quite annoying, if that file is part of a third party library and the virus warning is triggered every time TortoiseSVN checks it out. I ended up disabling the virus scanner, deleting the file and doing a commit. (Without disabling the scanner, I could not even do that :-( )

Answer 11

A couple of years back, everytime we updated the GNU Linker from mingw sources and started distributing it with our compiler, we got some reports that virusscanners classified ld.exe as virus. (.exes writing .exes ...)

Answer 12

I would not call it a "false positive", because, strictly speaking, it is not false and the antivirus software is not "guilty" of anything in any way.

I am 99% sure, that this is the heuristic analysis acting up (I bet it detects your executable as something along the lines of win32.virus.generic - note the generic, this is a sign, that this is not in its signature db, but rather was detected by the heuristics) and, with being heuristic and all, it does not give you any kind of guarantee, that whatever it finds is malicious, it just kind of makes it known to you, that the executable is suspicious from its point of view.

The easiest solution to this would be just adding an exception for your file by name (it is always the same name, correct?). If you are uncomfortable with this, you should, probably, make your antivirus software prompt you before taking action so you can make it skip your file manually.

In general, I've found coding in windows with antivirus software somewhat irritating (don't do it much nowadays, but still), especially if the said software is in "paranoid mode". Irritating as it is, though, it is unavoidable (IMO).

Answer 13

It happened to me too. Hooking keyboard will trigger almost any heuristic scanning AV software to report a key logger. There are probably many other system calls which will trigger it too. Solution - try to redesign your code or contact the AV manufacturer to include your software into exception list.

Answer 14

I remember another weird one:

A file was being flagged as suspect. The only thing is the file was an .OBJ! An .EXE that contained the code the .OBJ contained wasn't considered a problem.

Answer 15

There is indeed Delphi virus in the wild, see http://www.sophos.com/blogs/sophoslabs/?p=6117

Answer 16

If you have problems with false positives, there is VirusTotal online service that can help you check your file against number of antivirus engines.
It's free service and currently it can run antivirus check with almost 40 antivirus engines.