Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My company distributes software via website download off of a URL that is on our company's website. The download is an .EXE. We are getting calls from multiple customers saying the download is being blocked. We can help them download by turning off the virus-scan software, but wondering what is causing the block.

Here are the details: We have other downloadable .EXEs that download fine without being blocked from the same company website. Our problem download file downloads fine from other websites (i.e., Dropbox) without being blocked.

In summary, this one particular download from our company website is being blocked by various anti-virus programs a high percentage of the time. Any suggestions?

share|improve this question
2  
Hello! Please don't "cross-post" the same question on multiple sites. If it needs to be migrated because it's a better fit for another site, it'll be automatically moved by moderators or people with voting privileges. –  ÃŁŁǫǛȉЖΦΤїҪ Oct 24 '12 at 14:24
add comment

1 Answer

up vote 2 down vote accepted

Root Cause

Determining the root cause for this can be very difficult. The ultimate determination of the root cause would have to be made by the companies who maintain the virus scanners in question. However, I can provide some guesses that might provide you some leads. I would advise you however, not to assume that any of these guesses are accurate, without verifying with the virus scanner vendors first.

  • It may be that you are distributing and using a utility program that has been flagged as suspicious because it has been used by virus authors in the past. For example, certain open source programs that are part of a Cygwin or MinGW environment may be flagged by WebRoot, even though the programs by themselves are not malicious unless used in a malicious way by other code. Examples I've seen include cmp.exe and nircmd.exe.
  • Certain virus scanners use the cloud, plus community feedback from regular users, to automatically detect potentially malicious downloads. This can involve (a) users manually "flagging" the download as something they think might be malicious; (b) the software itself automatically determining that the user received a virus shortly after downloading your software; (c) the combination of your domain name and the executable name or contents triggering some type of filter or heuristic algorithm.
  • It could just be a simple false positive, where it was manually or automatically determined to be potentially malicious.

In all cases, determination of the root cause should be done by the virus scanner vendor. We can't tell, from the outside, what the actual problem is.

Resolution

To actually resolve the problem and to stop this from happening, the easiest thing to do is to ask the virus scanner vendors (each of them, individually) to please manually check out your download and/or your corporate reputation in order to determine that (a) your company website is a reputable vendor of legitimate software and (b) the downloads you are offering are not, in fact, malicious in any way.

Most virus scanner vendors have a way to report false positives on their website, or through the scanner program itself. You can continually test this and monitor the situation by setting up virtual machines or cheap test boxes and install a potpourri of virus scanners and check the download on a weekly or daily basis.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.