1

We develop software which will upload the files to a website. We are facing the false positive error from different antivirus vendors.
We have update file, downloader exe(which download the files from web) and full setup ( which includes update files). We will release the update as soon as there is any change in the website schemas to which we are uploading files.

When the customers run the update file or install a new setup they will get warning from antivirus vendors like Symantec, Norton that very less people have used this setup (less than 5) and last week Norton and Symantec deleted the our setup by giving warning “WS.Reputation.1” . Some antivirus vendors like 360 Total security give dll error (the file is trying to modify the system dll).

I used to scan in virus total before releasing but there I don’t get any virus warnings there.

I know I can white list my files before uploading to my server, but have a problem with that.

As I said our software is used to upload files to website, as soon as there is any change in that website I have to release the new update. But white listing will take certain time to upload the latest definitions to antivirus vendors servers and customers have to download that before running my setup in order to get rid of false positive. So I think white listing will not completely solve my problem.

What things I can do to overcome this problem?

Is there any way to keep history of my exe version with antivirus vendors so that they can trust my file?

Also how big software companies overcome false positive problem of antivirus?

1
  • Determine which part of your code is being flagged then change the code so it no longer is flagged. – Ramhound Feb 22 '16 at 13:14
1

I have seen the same issue. Most of the time whenever application try to open any port of the system then Anti Virus treats it as threat if application is not signed/certified.

You can try signing/ certification of your application.

More details available at https://stackoverflow.com/questions/252226/signing-a-windows-exe-file

3
  • Sorry, forgot to mention. My setup files are digitally signed. – IT researcher Feb 22 '16 at 10:17
  • @ITresearcher - What about the dll in question that is being flagged, is it signed by a CA, or just self-signed which is meaningless. – Ramhound Feb 22 '16 at 13:14
  • I am using signtool ( class 2) from microsoft to sign my codes. – IT researcher Feb 23 '16 at 5:20
1

I have decided to use EV code signing certificate, which will give reputation to my products automatically and some Antivirus vendors promised that false positive error wont affect EV code signed exes.

1
  • Can you add some more info about what an "EV" code signing cert is? – StayOnTarget May 14 '18 at 11:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.