title: How to prevent false positive virus alarm on my software?
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/3339136/antivirus-false-positive-in-my-executable">Antivirus False positive in my executable</a>  </p>
  </blockquote>
  
  
  
  <p>Until now, I had over 15 false virus alarms for my programs. Most of them were from Kaspersky, which reports ALWAYS the same virus: Trojan-GameThief.Win32.Lmir.pcd. 
  There are 3 questions:</p>
  
  <ol>
  <li>Why it appears?</li>
  <li>How to prevent it?</li>
  <li>How to detect it?</li>
  </ol>
  
  <p>For the first question, because it detects always the same virus, I guess it is because one of my routines that I use in all my programs. But which one exactly, I don't know.
  For the second question I was thinking about modifying the program just a bit and recompiling it, just enough to change its code so the antivirus will not recognize it anymore and release the new version.
  The third question is the most difficult one. How to check ALL my programs against ALL antivirus programs in the world? </p>
  
  <hr>
  
  <p>Update:<br>
  Has anybody knowledge about how this issue can be handled legally? There seems that many Delphi developers have the same problem. The reckless antivirus companies make money on our back by showing lots of false positive alarms, making their customers to think they are safe when there was actually no danger. While we are losing customers - they are making customers. 
  I informed the antivirus company about the problem but they fix it only for that specific version. Next time I release an update, the false alarm appears again. They just don't care.</p>
  
  <p>Many honest developers have problems because of careless antivirus software. 
  See this also: <a href="https://stackoverflow.com/questions/4237534/how-to-prevent-false-positive-virus-alarm-on-my-software">How to prevent false positive virus alarm on my software?</a></p>
  
  <p>Maybe we can unite against such antivirus products and force them to be more careful about false positive alarms, even to get some revenue back for the sales we lose because of them. 
  We should <a href="https://docs.google.com/forms/d/1H3_O1z1iEqfh9ZT9u3B0R1tGEj-Hc9o7rAE0LKPr33Y" rel="nofollow noreferrer">sign a petition</a> to let them know that we don't accept this anymore. </p>
  
  <p><strong>Update 2017</strong><br>
   * Last week my program had a detection ratio of close to 50% on VirusTotal. I deleted a single line of code and magically the detection dropped to 2 out of 61 (antiviruses). It is amazing how random these antivirus products behave.<br>
   * Detection is MUCH higher when the program is compiled is 'Release mode' (with compiler optimizations) then when it is compiled in 'Debug mode'.<br>
   * Detection sky rockets when EurekaLog is used.  </p>
  
  <p><strong>Update 2019</strong><br>
  It is almost 9 years later and not much improved.<br>
  Unfortunately, InnoSetup is not spared also. I created a dummy installer with InnoSetup and <a href="https://www.virustotal.com/gui/file/58c28f50a331faef1717a207e7989c215832458fd32b0cf44e007422ed3ed12b/detection" rel="nofollow noreferrer">upload it</a> on VirusTotal. 5 out of 52 programs reported a false positive! </p>
  
  <p>Conclusion: </p>
  
  <ul>
  <li>At the end of the day upload your exe file to VirusTotal. If the detection ratio suddenly jumps, review the changes you have done in your code and remove the "harmful" ones. </li>
  <li>Use WinRar 3 as installer. It raises less flags than WinRar 5 or InnoSetup.</li>
  </ul>