23

I work for a publishing company and we are making interactive software that accompanies our books. The problem is that many clients complain that the antivirus keeps deleting parts of the software, especially the .exe files.

Which is the best way to avoid this? By digitally signing the software? (I don't know if that's the correct term, or maybe it's called licensing). Are there companies who provide such a thing?

  • 11
    Sharing your research helps everyone. Tell us what you've tried and why it didn't meet your needs. This demonstrates that you've taken the time to try to help yourself, it saves us from reiterating obvious answers, and most of all it helps you get a more specific and relevant answer. Also see How to Ask – gnat Oct 24 at 11:11
  • 17
    check that your program hasnt been infected – Ewan Oct 24 at 11:45
  • 5
    As Ewan suggests, have a very good look at your tool chain. If that's infected by a virus, it can copy itself to everything you create. – Simon B Oct 24 at 12:13
  • 3
    Don;t write viruses – mattnz Oct 25 at 3:31
  • 2
    Tell the antivirus vendors in question that your files are not infected and have them fix their databases. – Thorbjørn Ravn Andersen Oct 25 at 9:51
46

By running that same anti-virus software in your testing environment. Make it part of your test procedure: "Software not deleted by antivirus."

(In my experience: some packers, which compress your executable, will make your executable get flagged.)

  • 1
    @Christophe or just add a test round, installing the software from the medium you distribute it on. – Ruslan Oct 24 at 20:09
  • 1
    Couldn't this get expensive, to license all the different anti-virus software that flag your executables? – Nacht - Reinstate Monica Oct 25 at 0:21
  • 1
    @Nacht how expensive could it possibly be? You only need one or at most a handful of licenses for each for your CI server(s). We're talking about end-user software, copies costing maybe $50-100 USD a piece. – Jared Smith Oct 25 at 1:58
  • 2
    @Voo That's a generic advice for a normal-use computer regarding auto-scan. For a validation machine, you can turn off auto-scan and simply run all the scanners in sequence. The main issue is how they can create conflicts with each other on quarantined files e.g.) AV1 detects virus, quarantine files, but this gets detected by AV2, which quarantines it somewhere else, and then triggers AV1 from the quarantine, etc. – Nelson Oct 25 at 7:27
  • 3
    Even if AV doesn't delete your software today, doesn't mean it will still leave it tomorrow after an update. – Alice Oct 25 at 11:17
29

There's no magic cure unfortunately. False positives by anti-virus software have been a problem for commercial publishers for a long time. It is very common, especially for smaller publishers.

The first thing you want to do is sign all executables in your project as well as the installer. That will go a long way towards helping you. But its still no guarantee the programs won't be flagged. To sign software you'll need a software signing certificate. It takes a little bit of effort (and money), but its worth it.

You'll also want to make sure your program plays nicely with Windows, and doesn't do things like writing to places on the drive it shouldn't (such as the Windows directory). Make sure you understand where files should be installed and written to under Windows.

If your program is still getting flagged, you can use a tool like VirusTotal which checks your file against all the major published anti-virus programs. This way you can see which ones are reporting false positives. Usually its just one or a few that are flagging the program. From there if need be you can submit your program to those anti-virus publishers. Most of them have a place where you can do that on their website. This is hit or miss, don't expect immediate responses from them.

-1

Going by current tech - and your software will be most likely developed or at least built for Windows (10 .. 64 bit ) - get an official licensed developer key from Microsoft to sign your installer and program.

Avoid exe-packers like upk/upx like the plague, stick to well known formats like (7)zip or rar - or use a packaging software to build your installer.

Not the answer you're looking for? Browse other questions tagged or ask your own question.