We make free software available on our web site. A few years ago, one of the virus scanners started complaining about some of our executables. We rebuilt everything from source code, verified things were working correctly, etc. There are no viruses or any other malware in our executables.
Apparently the less sophisticated virus scanners just a do simple pattern match, and something in one of our low level libraries when linked into most programs matched a pattern.
This was just a annoyance for a few years, and even seemed to get better over time. Probably as changes were made to software, some executables got linked differently and no longer had whatever pattern was triggering the virus scanners. However, a few months ago things got dramatically worse. Apparently Google is using one of these virus scanners that indicates a false positive, and now throws up nasty warnings, blocks Chrome from getting to our site, etc. Even worse, I just found that our ISP (InfoQuest) apparently just took Google's warning at face value and renamed one of our files without asking us or even notifying us.
This has now become a serious problem that can no longer be ignored. How do I fix this? Talking to tech support at a virus scanner company doesn't go well. The support droids just can't seem to wrap their minds around the fact that their software is wrong. I can't fix this at our end because there is nothing actually wrong with our executables. I even sent them a test case once, but of course never heard anything back.
In case anyone wants to see, the page in question is http://www.embedinc.com/pic/dload.htm. Unfortunately, this is not always there as it gets renamed or removed occaionally. We offer a bunch of free software there that contains Win32 excutables, but none of them contain any malware.
What do I do about this?
Some Linux Nerd commented:
If you unpack it it looks like it's due to a handful of utilities: embedinc/com/flines.exe waitenter.exe get_pic_info.exe hex_dump.exe sum.exe test_embusb.exe test_env.exe Not really helpful. It's being misdetected as f-secure.com/v-descs/trojan_w32_ransom.shtml by a number of AVs.
Yup, that's exactly the problem. These are all programs derived from our own source code all the way down to OS calls. They are utilities that do various handy things for us. I can assure everyone that none of them contain any malware. I've rebuilt them from source code (which is available in the "everything" release from that same page) just to be sure, but get the same thing.
It's not just one program. There is something probably in a commonly used low level library routine that looks like malware to less sophisticated scanners.
The question here is how to get Google and various malware scanners to stop warning everyone about our programs since there is actually nothing to warn people against.
