Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 3 down vote favorite

I created a dll file with gcc(mingw). When I start my application Microsoft Security Essentials notifies me:

Security Essentials detected items on your PC that it doesn't recognize

Why does this happen only with my DLL and not with other DLLs?

share|improve this question
NO it should not be because anybody can use application..He/She need not to be Admin.. For example anyone can use VLC Media player.. – twid Sep 28 '12 at 16:40
But the SO FAQ disagrees. It is not a question related to coding in any way. Maybe it is a problem with MSE, or maybe your GCC is infected. – Hindol Sep 28 '12 at 16:42
No, then why it doesn't happen with other DLL, which are being used by many other App – twid Sep 28 '12 at 16:44
2  
This is a strange problem. It is quite impossible to solve with only this much information. – Hindol Sep 28 '12 at 16:48
NOw my question is what make Microsoft Security Essential to recognise any item..like it is DLL or exe – twid Sep 28 '12 at 16:51
show 6 more comments

migrated from stackoverflow.com Oct 1 '12 at 3:08

2 Answers

up vote 1 down vote
+50

Microsoft both has a page for sending in false positives and negatives as well as resources for software vendors. You could also exclude those filetypes (or preferably specific files you know aren't viruses from the settings tab.

My guess would be MS gets hashes and information on common DLLs and yours is uncommon.

share|improve this answer
hmm... hashes looks logical to me....But if MS keeps records of DLL hashes them would be very difficult for them to maintain over the period...Because there might be at least hundreds of DLL being generated on day... – twid Oct 1 '12 at 9:41
Large hash table lookups are easy enough, especially if the PC sends it off to the cloud to have it looked up. – Michael Hampton Oct 7 '12 at 22:03
up vote 1 down vote

MSE and all other antivirus products recognize viruses by virus signatures. Each such antivirus uses a database containing many thousands of signatures. A signature is a pattern-recognition rule that supposedly identifies a virus file by its binary hash. Some viruses add files, others modify existing system files, some others make registry changes that signal their presence.

For more details see What is a Virus Signature?.

The simplest way to stop this message is in MSE is to go to the Settings tab and add the dll file or its folder to the list of Excluded Files and Locations.

You might also check if under MAPS you have opted for "Advanced membership" so that MSE feels free to prompt you to send unknown items to be analyzed. Set this to "Basic membership" or even if the message continues to "I don't want to join".

Otherwise, you could try and submit your dll to Microsoft at the Submit a sample page, in the hope that this will render your dll into a "known" dll, but don't hope for too much.

share|improve this answer
Yes, obviously that’s what’s happening since it cannot be heuristics for a static scan of a DLL. And yes, you can add it to an exclusion list and submit it, but the question asked is why it happens. That is, why is a presumably innocuous DLL being built with the same framework that others are using being flagged, not how it can be worked around. For example, is it a known bug with the framework or version used? Do others experience it with their DLLs? Is it a bug with MSSE?… – Synetech Oct 3 '12 at 18:14
@Synetech: This dll has happened to come up as a possible threat for one of the very complex heuristics used by MSE. It can be that there is a combination of factors, such as a suspicious system call that it does plus other factors, that caused MSE to flag it as a possible hazard. Only an MSE developer can find out exactly why, but I would guess that it's an accumulation of factors. – harrymc Oct 3 '12 at 19:43
> Only an MSE developer can find out exactly why.   Not if it’s a known issue. – Synetech Oct 4 '12 at 1:52
@Synetech: Of course you are right, but I don't know of any such "known issue". False positives are well-known and the only fix is a change in the detection rules. In this case this is not a false positive, just a dll that does a number of system calls (or other suspicious stuff), enough that MSE decides that it should be studied by a human being who will decide whether to white-list it or not. – harrymc Oct 4 '12 at 4:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.