Why So Many False Positives?

[Dennis1]

I've written a few Lazarus programs that I depend on in my job. Unfortunately, virus scanners often flag them as malware and delete them without warning. I have lost a lot of work because of this. I've tried F-Secure, Bitdefender, Avast, Avira, and Microsoft Security Essentials, and only MSE doesn't have the problem.

I should add that I know the code in these programs quite well and there is nothing dodgy going on. They are all fairly basic by most programming standards. My computer is clean, and I've tried the usual reinstalling and recompiling from scratch etc.

Thoughts?

[marcov]

There are many similar threads on the forum, so I suggest you search a bit.

Basically antivirus writers are lazy.

[Thaddy]

Not all of them. But at least on Windows use Defender. It is simply better than the old school F-Secure, Bitdefender, Avast, Avira, or God forbid, McAfee or Norton.

But always report a false positive and refer to the startup code, the compiler, the sourcecode, etc.

[rvk]

Not all of them. But at least on Windows use Defender.

Microsoft hasn't fixed the current false positive yet which you reported.
Even today I got a false positive with Windows Defender.

(I normally compile in an excluded directory but when compiling an unsaved project it goes to %temp% and I'm not going to exclude that one  )

I'll report next one I'll get too.

[Thaddy]

Strange, but I am on an MS - soon to be released - beta 11 developers release. I know they fixed it.
Simply report it yourself too. You know how, complete.
(meaning I get versions before the consumer does)

[jamie]

This is what I've noticed, if you have some JS/Java constants in your code, it triggers the virus detection.

[Wallaby]

I guess your code is unsigned, while the majority of legitimate apps carry digital signatures.

I have a bunch of Lazarus-produced apps and they seldom cause a false positive, likely because they are signed with an EV certificate.

Though depending on what you do, it may not be worth it as they are expensive and only available to companies.

[n7800]

(I normally compile in an excluded directory but when compiling an unsaved project it goes to %temp% and I'm not going to exclude that one  )

You can change the directory for temporary projects - just open the IDE options (Ctrl+Shift+O) and you will immediately see the option "Directory for building test projects".

[domasz]

I guess your code is unsigned, while the majority of legitimate apps carry digital signatures.

That has been invented just to make more problems for small teams, make them poorer and so Microsoft can say they try to defend computers against malicious software. It gives no extra security for users. There's lots of signed programs made by huge corporations that are evil, spy on people and steal personal data. There are signed programs that break the OS (like some Windows updates).

Instead Microsoft should improve Windows and make it more secure. Windows Defender is a good step towards that.

[Dzandaa]

Hi,

I tested a lot of antivirus next year

The worse was Bitdefender, eating my RAM.

And the conversations with the helpdesk were epic

I was a big fan of Avira, a few years ago, my company had a site License.

But now, it's full of plugins, like Phantom VPN and Speedup.

So my solution for Windows is... MS Antivirus + Comodo Firewall
and this: https://www.oo-software.com/en/shutup10 for other sort of Spywares



B->

[marcov]

I'm a fan of Winaero.