Antivirus False positive in my executable

delphi delphi-7 executable antivirus false-positive
Ricardo Acras picture Ricardo Acras · Jul 26, 2010 · Viewed 11.6k times · Source

I just ran into an annoying problem. Suddenly Avira AntiVir started to flag one executable from my software as being a virus.

As the default action from almost any user is to click OK and Avira suggests to put the virus in quarantine, most of my users are deleting this executable.

Well, let's not be arrogant and check if I'm not infected indeed. I posted the file to http://www.virustotal.com and from all anti virus only Avira flags it as infected. Furthermore I scanned my computer with two different anti viruses and it is clean.

I already posted a mail to my users explaining what is happening but this is an overhead to my support that I really don't want.

OK, the question is: Is there a way to avoid this kind of behavior? I can't think any way else than signing the files, (don't really know if it would solve) but let's see if you have any creative idea.

Answer

Andreas Rejbrand picture Andreas Rejbrand · Jul 26, 2010

It is surprisingly common that Delphi applications are reported as (potentially) harmful by AV applications. It happened to me a while ago, using Delphi 2009, see http://en.wikipedia.org/wiki/Wikipedia:Reference_desk/Archives/Computing/2010_March_20#Delphi.2FAVG_Issue.

At SO, we also have

and many more.

It might be the actual Induc Virus. But most likely, it is a false positive.

Related questions

ms sql xml data type convert to text

in MS Sql there are data types that are not supported by delphi 7, the xml datatype is one example. I wish to convert the XML datatype to Text datatype, so that i could handle it in delphi. Is there a …

Read More
Delphi isNumber

Is there a method in Delphi to check if a string is a number without raising an exception? its for int parsing. and an exception will raise if one use the try StrToInt(s); except //exception handling end;

Read More
Delphi: StringList Delimiter is always a space character even if Delimiter is set

I am having trouble with the delimiter in the TStringList Class. Take a look: var s: string; sl: TStringList; begin sl := TStringList.Create; s := 'Users^foo bar^bar foo^foobar^barfoo'; sl.Delimiter := '^'; sl.DelimitedText := s; ShowMessage(sl[1]); …

Read More