Best practices to avoid having legit program being flagged by virus scanners?

cdevidal · 10th October 2021, 11:01

I'm creating an app for SecureCoop.com, no malware, but Microsoft antivirus keeps flagging my installer as malware. First Trojan:Win32/Wacatac.B!ml then Backdoor:Win32/Bladabindi!ml.

I can't be unnecessarily scaring my users. What are the best practices to avoid this happening?

cdevidal · 10th October 2021, 11:05

My app consists of a systray executable and I will also soon be adding a system service. The systray .exe monitors the service and reports to the user on failure. I had placed a shortcut in $SMSTARTUP, and I wondered if that is cause it to flag as abnormal behavior. If this is not the recommended action for a systray, please share a better solution.

The app is written in Python then compiled to .exe with pyinstaller.

cdevidal · 10th October 2021, 11:17

I think I will pursue Comodo code signing. What else?

cdevidal · 10th October 2021, 11:19

Forgot to mention: My systray .exe has a built-in Bottle.py tiny web server, which could also be causing it to flag.

If only I could edit my posts here...

10th October 2021, 11:01	#1
cdevidal Junior Member Join Date: Oct 2021 Posts: 8	Best practices to avoid having legit program being flagged by virus scanners? I'm creating an app for SecureCoop.com, no malware, but Microsoft antivirus keeps flagging my installer as malware. First Trojan:Win32/Wacatac.B!ml then Backdoor:Win32/Bladabindi!ml. I can't be unnecessarily scaring my users. What are the best practices to avoid this happening?

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

10th October 2021, 11:05	#2
cdevidal Junior Member Join Date: Oct 2021 Posts: 8	My app consists of a systray executable and I will also soon be adding a system service. The systray .exe monitors the service and reports to the user on failure. I had placed a shortcut in $SMSTARTUP, and I wondered if that is cause it to flag as abnormal behavior. If this is not the recommended action for a systray, please share a better solution. The app is written in Python then compiled to .exe with pyinstaller.

10th October 2021, 11:17	#3
cdevidal Junior Member Join Date: Oct 2021 Posts: 8	I think I will pursue Comodo code signing. What else?

10th October 2021, 11:19	#4
cdevidal Junior Member Join Date: Oct 2021 Posts: 8	Forgot to mention: My systray .exe has a built-in Bottle.py tiny web server, which could also be causing it to flag. If only I could edit my posts here...