How do you deal with false positives from antivirus companies (Avast and ClamAV)?

EKS picture EKS · Nov 28, 2011 · Viewed 8.6k times · Source

Possible Duplicate:
Antivirus False positive in my executable

One application is currently getting detected by a false positive for virus by Avast and ClamAV (never heard of the latter).

I have contacted both and waiting for reply from them, but I guess that takes it time (24 hours ++ now). So what I'm looking for a resource to check if for part of my code is being falsely detected, I personally assume ME and the person who write a virus at one point simply have commen sample code?

I dont have the technical ablities so i could disable the AV and find what signture is triggering ( And i assume companies protect this information). So my question boils down to, is there any resource i can use to check part of my code is being detected?

Extra information:

  • Link to VirusTotals:
  • My application is digitaly signed, and "my" signature has a postive rating at least with MS and never heard anyone complain that its blacklisted.
  • My application does have background update checking and error reporting ( update check is done via http)
  • I have off course scanned my computer used for compiling for viruses ( Both MS and NOD32 )
  • Application gets detected as a false positive detection even when its just zipped and not in a installer.
  • Link to information about what my app is being falsely detected as (Thx to Flanfl )

The people voting to close, please actual read the topic https://stackoverflow.com/questions/3339136/antivirus-false-positive-in-my-executable, one is about Delphi coding. Mine is generic and has a 2 actual replies that helpful to my case.

Answer

drharris picture drharris · Nov 28, 2011

In the end, there's going to be no one technique that will solve your problem. Signing won't help, and changing names probably won't help; otherwise viruses would use those same ideas to circumvent security. Those AV products have found some chunk of code that matches the virus, and aren't smart enough to distinguish. I would suggest contacting the specific AV providers and getting them to whitelist you.