Hello all,

As of trunk r48648, Windows Defender deletes fp.exe after compilation because it considers it an infected file. It claims that fp.exe is infected with Trojan:Win32/Fuerboos.E!cl and quarantines the file.

Anyone else is experiencing this? Any idea why is this happening?

Unfortunately from what I've read just using certain Windows APIs is enough to get an executable flagged. Probably nothing to be too concerned about.

Not only Windows Defender:

After a compiler  run sometimes BitDefender moans (seldom) that the binary is some malware.

Adding (or deleting) some code, another compiler run  and the phantom is gone.

The Anti-Virus programs use a heuristic because of the immense ammount of malware and virus.

It is no pattern matching anymore like in the "old days".

So the number of false positive alarm increases.

Example: After using 7 years the YajHFC (Yet another Java HylaFAX client) on our Windows clients

Bitdefender suddenly moant that it is malware: False positive.

Winni

AM Alexander Bunakov wrote

As of trunk r48648, Windows Defender deletes fp.exe after compilation because it considers it an infected file. It claims that fp.exe is infected with Trojan:Win32/Fuerboos.E!cl and quarantines the file.

I exclude the folders where fpc/lazarus reside from scanning. Also the folders where I develop my programs.
If you don't you're bound to get strange bugs and thing like this.

Bart wrote

I exclude the folders where fpc/lazarus reside from scanning. Also the folders where I develop my programs. If you don't you're bound to get strange bugs and thing like this.

Yes, that's a very good idea. We do the same at work for our Java, iOS and Android projects. Those projects generate 1000's of files while compiling etc. We know they don't contain viruses, so why let the virus scanner scan then. On Android machines it made a massive difference for compile speed too.

Regards,
Graeme

Are signed executables subject to anti-virus inspection?

The problem I have had is when programs I compile generate a false virus detection.. sure on my own computer I can just disable that directory from the virus scanner but it becomes a problem when I release it to my customers and their virus scanners quarantine it. I have no idea how to register a legitimate program as not having a virus. I've had this issue before but managed to track down the section of code that caused it... after a completely exhaustive search.

James

How does one sign an executable?

James Richters wrote

I have no idea how to register a legitimate program as not having a virus. I've had this issue before but managed to track down the section of code that caused it... after a completely exhaustive search.

Anti virus providers normally have page where you can submit false positives.

For windows defender it seems to be here. (unlike most other AV companies, you need to sign in)
https://www.microsoft.com/en-us/wdsi/filesubmission

Of course that needs the exe to be detected (well I don't know if AV companies accept submissions that are not detected). If you release today, your exe can still be detected as avirus in a few month. Once it is detected, you can submit it.

That may not solve the issue for self build fp.exe . If the AV whitelists the exact exe, it will fail the next time you build, because fpc includes a timestamp (afaik)

How it's done in FPC I don't know, but in other language tools I use, it requires a resource file with spefic information in it.  I can never remember all the details, so I have to keep a template resource file around with the required information in it, and change it for each program  work on.

In general I don't bother with the resource file during testing, but when I release a full version, I apply the resource file to the executable, and that usually takes care of the issue.

I've also noticed that if you have any timing routines in your code, it tends to get flagged by virus scanners.  No clue why, but I've run afoul of that issue more than once.

I've also noticed that if you have any timing routines in your code, it tends to get flagged by virus scanners. No clue why, but I've run afoul of that issue more than once.

Debugger detection?

Op 2021-02-12 om 22:48 schreef James Richters via fpc-pascal:

The problem I have had is when programs I compile generate a false virus detection.. sure on my own computer I can just disable that directory from the virus scanner but it becomes a problem when I release it to my customers and their virus scanners quarantine it. I have no idea how to register a legitimate program as not having a virus. I've had this issue before but managed to track down the section of code that caused it... after a completely exhaustive search.

Some tips:

 - don't use debug builds.

 - sign the binary, even if just selfsigned. Provide as much context to the OS (icon and the rest in that screen). Minimalistic binaries seem to be more suspect.

- use a well known installer package, and insist on using installers. Copied exes are also more suspect.

- unfortunately, some wellknown Delphi libraries like Indy and Zeos sometimes trigger also.

There is no real failsafe solution. It is all hedging and hoping.

Travis Siegel wrote

that if you have any timing routines in your code, it tends to get flagged by virus scanners.  No clue why, but I've run afoul of that issue more than once.

I read somewhere that some viruses have a build in wait, to evade sandbox detection. AV companies let unknown exe run in a sandbox, and wait if they behave bad.
Viruses evade that by being dormant for a while.

Hello,

For one software I compile with fpc, Avast always complained. But only when compiled for debugging. That exe was sent to the false positive departement, and it toke about _one mounth_ to have a corrected version of the AV. Afterwhat, he never complained even with reworked source code.

Cheers, Ched

Le 13.02.21 à 12:02, Marco van de Voort via fpc-pascal a écrit :

I've seen a few false positives on debug info. To be fair, the AV can't really tell its not code. It could be used like a resource, later to be loaded from the file and then somehow be executed. So if debuginfo happens to look like malicious code....