Login/Register
Accidentally created a virus?
Asked Answered
Solved delphiantivirusvirusfalse-positive
T

17

61

I've seen it happen reasonably often: I write an application in Delphi and when I compile it, the virus-scanner tells me that I've created a virus and then immediately deletes the executable again. It's annoying but reasonable easy to fix by doing a full rebuild, deleting the *.dcu files first and sometimes by simply waiting.

It happens with Delphi 6, 7, 2005 and 2007, as far as I know. And Symantec, Kaspersky, McAfee and NOD32 have all been guilty of reporting these false positives. I know it's because Delphi adds timestamps to its DCU files and these timestamps end up in the final executable and apparently appear to be part of some random virus signature.

I don't want to disable the virus-scanner, not even for a single folder or file. And I'm not really for a solution, but am wondering about the following:

  • Do these false positives also occur with other compilers?
  • Does it also happen with .NET executables?
  • Do others also notice similar problems with Delphi?
Theran answered 14/6, 2009 at 20:21 Comment(5)
Just want to add that this error is quite rare, but it still happens about once every three months with me or one of my collegues. – Theran
Karpesky flagged as virus one program I did. I emailed them and they fixed it for the following updates. – Order
@Tom, Delphi's prevalence might have more to do with pascal like languages being popular in East Europe. – Toadinthehole
It's not a false positive: Win32/Injector.CKX trojan – Wine
If it is the Win32/Injector.CKX trojan then McAfee and other virusscanners should report this for every project that's compiled with Delphi. However, recompiling the project on another system with the same files, or recompiling everything a few hours or even a day later had no more warnings. As Tom suggests, Delphi used to be great for writing malware, thus some malware signatures might match those of innocent Delphi applications. (Simply because the signature is too generic.) – Theran
A
104

Do these false positives also occur with other compilers?

Yes, this is has been a common problem in the past for AutoIt as addressed in this forum post "Are my AutoIt EXEs really infected?". In most cases including AutoIt it stems from poor heuristic practices. Since AutoIt uses the free and open UPX compressor, it is often mistaken for malicious code that also uses UPX.

The best (and possibly only) thing you can do is report these mistakes, so they can refine their heuristics or at least white list your app.

Below is a list of contact information for some popular anti-virus companies. They all claim to appreciate submissions as it helps them make their product better.

Turns out there is a great list of AV software on wikipedia, called 'List of antivirus software'. It is more complete than my list above.

A member of the Autoit Forums made a great script to e-mail a false positive to a huge list of AV vendors to automate this process a bit.

Annabelleannabergite answered 14/6, 2009 at 20:57 Comment(7)
But they are only interested if you are the author. For years McAfee declared an .OBJ file on my system a potentially unwanted program--yet it had no problem with an .EXE incorporating it. I wasn't the author, though, and since it was an old, no-longer-supported version the author wasn't going to do anything. – Elidaelidad
@Loren: Interesting, I wasn't aware they made such distinctions. Thanks for the heads up! – Annabelleannabergite
Another for your list (I don't have the rep to edit), VIPRE from Sunbelt Software, www.sunbeltsoftware.com – Drive
@Copas: that's "Vipre", not "Viper" - since you're trying to set up a reference list – Drive
Note that UPX is not all that useful. It makes your programs take significantly more memory to run and has far fewer benefits on modern systems than it had earlier. – Dapsang
There is a any successful law suit again an antivirus company? – Helaine
More than that, AutoIt scripts are Turing complete and can contain embedded binaries so Trojan droppers use it a lot. Unfortunately the antivirus detects viruses on the AutoIt shell rather than reading the embedded script. Boo. An AutoIt script that doesn't drop an executable probably isn't infected. – Mordred
A
11

Sounds more like a heuristic screw-up to me. Do you have heuristics turned on (some scanners may refer to it as "virus-like code")? The chances that time stamps would equate to "a portion of some virus signature" seems too small to be happening all the time.

When I used to run a virus scanner, I never saw this problem with D6 or D7.

Anthiathia answered 14/6, 2009 at 20:30 Comment(1)
Yes, heuristics are on. Not that I mind, since the computer should be kept secure so I rather deal with the occasional false positive than to be the source of infection. I'm often working on software for the financial market and thus much of it is sensitive information. – Theran
F
9

There is indeed Delphi virus in the wild, see http://www.sophos.com/blogs/sophoslabs/?p=6117

Footstep answered 15/11, 2009 at 3:17 Comment(0)
I
8

Yes, my team has experienced this maybe half a dozen times in 2-3 years with Sophos in a corporate environment. So, very rarely, but it does happen.

Our IT cretin started off demanding I review all the 1.5M lines of code in our app to "make it go away", but he didn't get too far pursuing that line...

To be fair, he was initially concerned that our clients might also receive such a warning, but we've only ever seen it triggered when building an exe from the IDE on a developer's PC, never on a release build exe on a test box or elsewhere.

Personally, it happens so rarely we don't worry about it.

Ion answered 14/6, 2009 at 22:18 Comment(1)
I'm not worried about this too. It's just annoying since it means some additional delay when building a new executable. It's a bit worse on our automatic build server, though. The compilation goes okay but since the executable is deleted immediately, it just chokes to death on such occasions. But again, it's extremely rare. (And on the build server, a new build run just fixes it again.) – Theran
E
5

I've had it happen to me with deployed code. The next update to the scanner solved the problem. Some cretin wrote a virus using the same compiler and the signature was part of the runtime library, not actually in the hostile code.

Elidaelidad answered 14/6, 2009 at 23:7 Comment(2)
This is similar to the problem AutoIt often has. I feel your pain, with deployed code it is very difficult to (fully) convince the customer that it is a false positive. – Annabelleannabergite
It's in-house for me, I'm known to the people running it. – Elidaelidad
D
4

This is not that uncommon when using non-standard compilers or when doing fancy low-level stuff: I remember creating false positives when I dabbled in OS-development: AntiVir didn't like some of my flat binaries.

Recently, there's been a post about such a problem at the tinyCC mailing list regading AVG.

Daedalus answered 14/6, 2009 at 20:32 Comment(1)
Actually, I know that I only have to call a single windows API function in a DLL project to trigger alarm bells on almost every virusscanner. (The keyhook API is considered suspicious.) But to get around the false positives, I don't have to change the sourcecode. All I need to do is throw away the DCU files (Delphi Compiled Units) so it will rebuild these again, with different timestamps, thus apparently generating a different signature. – Theran
H
3

I've never seen this, having done lots of C++ and .NET development with Visual Studio (from version 1.5 to 2010).

Haloid answered 14/6, 2009 at 20:28 Comment(1)
The first infection by a C# virus is still in progress, so please give it some time. It needs a 250MB framework and administrator rights to install you know. :-) – Calvinism
R
3

I've only seen this happen with assemblers. For example, MASM32 actually warns people that it might trigger virus scanners since the EXEs are so small (and/or some viruses are written in assembly). My McAfee scanner flagged some of the example programs as viruses.

This should only happen for virus scanners that have a "looks suspicious" analysis mode.

Reis answered 14/6, 2009 at 20:29 Comment(0)
I
3

In some apps, if I use RtlVclOptimize.pas, the Avira antivirus tell that I have created a virus.

Idden answered 15/6, 2009 at 0:6 Comment(1)
That's interesting, because Avira doesn't warn me about a virus in all our applications. Maybe it is the combination with other units. – Strained
I
3

plus to what others'v said, modern anti-virus programs rise virus-alert if your programs uses some "suspicious" APIs too ( like URLdownloadFile or other API hooking related ones). if you google "delphi RAT FUD API undetectable" you'll find many interesting topics .

Ionia answered 15/6, 2009 at 4:9 Comment(0)
L
3

Some antivirus programs even flag a batch file as a virus and can't be convinced that it isn't. Quite annoying, if that file is part of a third party library and the virus warning is triggered every time TortoiseSVN checks it out. I ended up disabling the virus scanner, deleting the file and doing a commit. (Without disabling the scanner, I could not even do that :-( )

Lettyletup answered 15/6, 2009 at 5:32 Comment(0)
B
3

If you have problems with false positives, there is VirusTotal online service that can help you check your file against number of antivirus engines.
It's free service and currently it can run antivirus check with almost 40 antivirus engines.

Betwixt answered 27/7, 2010 at 10:41 Comment(3)
That wouldn't be practical when my AV software reports a virus in some executable that I just compiled. I know it's not a virus, unless I wrote one myself. The problem is that the AV is blocking my compilation process when a false positive is detected. It's annoying. – Theran
I know. VirusTotal is just a place that can tell you which Antivirus engines falsely see your software as virus and you can then contact them and ask them to fix the problem. – Betwixt
If you have accurate positives I imagine it's similarly useful, unfortunately. – Fugitive
G
2

A couple of years back, everytime we updated the GNU Linker from mingw sources and started distributing it with our compiler, we got some reports that virusscanners classified ld.exe as virus. (.exes writing .exes ...)

Gallardo answered 15/6, 2009 at 7:33 Comment(0)
P
2

I would not call it a "false positive", because, strictly speaking, it is not false and the antivirus software is not "guilty" of anything in any way.

I am 99% sure, that this is the heuristic analysis acting up (I bet it detects your executable as something along the lines of win32.virus.generic - note the generic, this is a sign, that this is not in its signature db, but rather was detected by the heuristics) and, with being heuristic and all, it does not give you any kind of guarantee, that whatever it finds is malicious, it just kind of makes it known to you, that the executable is suspicious from its point of view.

The easiest solution to this would be just adding an exception for your file by name (it is always the same name, correct?). If you are uncomfortable with this, you should, probably, make your antivirus software prompt you before taking action so you can make it skip your file manually.

In general, I've found coding in windows with antivirus software somewhat irritating (don't do it much nowadays, but still), especially if the said software is in "paranoid mode". Irritating as it is, though, it is unavoidable (IMO).

Pancreatotomy answered 15/6, 2009 at 7:46 Comment(2)
Actually, the problem can occur with ANY source that gets compiled in Delphi so the filename varies. Making an exception for the executable would increase the risk in a very small amount, but I'd need to do that to get around a very rare problem. Especially since there's a simple work-around, it's not a real problem. Just annoying when it happens. And as I said, our systems work on financial applications so we're paranoid all the time. ;-) Annoying, but required. – Theran
How can it not be a false positive? The AV software falsely identifies it as malware. The meaning of "false positive" depends on the result, not whether the process is reasonable or not. Lots of reasonable processes yield false positives. – Daphinedaphna
E
2

I remember another weird one:

A file was being flagged as suspect. The only thing is the file was an .OBJ! An .EXE that contained the code the .OBJ contained wasn't considered a problem.

Elidaelidad answered 9/9, 2009 at 2:1 Comment(0)
M
1

It happened to me too. Hooking keyboard will trigger almost any heuristic scanning AV software to report a key logger. There are probably many other system calls which will trigger it too. Solution - try to redesign your code or contact the AV manufacturer to include your software into exception list.

Marker answered 16/6, 2009 at 11:56 Comment(1)
Had that problem too. Had a Delphi unit that was used in an executable, and it implemented a keyhook. Then the unit was used in a DLL to run under Outlook and it appeared to be working. But it set off quite a few virusscanners except the Kaspersky scanner that I used back then! Then again, it was even worse, since the DLL installed the keyhook in every process. That's not possible when the API is called from an executable. – Theran
G
1

VS Platform toolset 2010 renders my simple program to be detected as virus. Changing the toolset to VS 2013 solves it.

It just creates a HttpWebRequest and writes the result to a file.

Gild answered 20/5, 2016 at 7:0 Comment(0)

© 2022 - 2024 — McMap. All rights reserved.