Compiled C executable is detected as a virus by windows defender

Question

I had compiled a simple hello world program in C with the MinGW compiler using the command line. As it had finished compiling, windows defender popped up and detected a virus (Trojan:Win32/Fuery.C!cl).

#include <stdio.h>
#include <stdlib.h>
int main() {
    printf("Hello World");
    return 0;
}

https://i.stack.imgur.com/qGUYo.jpg

I had taken action on this (Removed) as windows defender suggested, but when I compile again the same happened, multiple times.

I had downloaded an AntiVirus (Malwarebytes) and scanned my whole system and it detected some registry key errors, but not this.

I've tried compiling C++ files too, but windows defender did not detect any virus there. This only happens when I compile in C.

I've also tried checking the compiled executable at VirusTotal. https://www.virustotal.com/gui/file/476d47215dad80db49c9fd508ab5e10e5aeb5b623248ca156830a28b70affe5f/detection

I tried CodeBlock's MinGW compiler and 0 engines detected it. (Same C file) https://www.virustotal.com/gui/file/8ba4b0fa24b1b6b69152acce2353fcca8447bbecbfc4e5ec48d33cc75d94f2f1/detection

EDIT: I deleted the path variable of C:/MinGW and added CodeBlock's MinGW compiler. I then used the command line to compile the same C file again and had uploaded the .exe file to VirusTotal. This time, 0 engines detected. So I have come to the conclusion that, the MinGW compiler that I had installed was creating this problem. https://www.virustotal.com/gui/file/34d383f6c09f897d8c9a44ed0e7850574320e50fdf439eeb1f06705fdcc95386/detection

I don't know why this happens. Is there a malware in my computer that affects my C programs or is this a false detection?

Answer 1

There is no malware, it is a false positive. The executable generated by your version of MinGW looks very similar to a particular virus.

To avoid the problem, add the directory where you build your code to the list of exclusion in the antivirus.

Also consider using mingw-w64 instead of mingw.org .

Answer 2

I came across with the same problem, compiler tdm gcc v9.2.

The following compilation triggers a warning (kaspersky).

gcc temp.c -o temp.exe

The following does not

gcc -O3 temp.c -o temp.exe

Where temp.c is

#include <stdlib.h>
#include <stdio.h>
#include <math.h>
int main() {
    int a, b;
    scanf("%d %d", &a, &b);
    printf("mod %4d, %4d is %4d\n", a, b, a%b);
    return 0;
}

The same code with g++ passes the test with both compilations. The antivirus software does not detect the same virus elsewhere but only in temp.exe (first compilation).

Answer 3

I may have solved my problem.

This is what I did: I removed the PATH Variable of C:\MinGW and added CodeBlock's MinGW compiler (CodeBlocks/MinGW/bin). I used the command line to compile the same C file, and had uploaded the .exe to VirusTotal. No engines detected this file! https://www.virustotal.com/gui/file/34d383f6c09f897d8c9a44ed0e7850574320e50fdf439eeb1f06705fdcc95386/detection

So I have come to a conclusion that, MinGW was the compiler that was causing this problem. I have removed it.

However, I am not quite sure if this problem is FULLY solved. There is still a possibility of malware affecting my executable (or perhaps not). I cannot be sure.

If anyone has any answers, please comment or answer

Answer 4

Since you wrote that program and you know it isn't actually a Trojan, it's obviously a false positive. You should submit the file to them at https://www.microsoft.com/wdsi/filesubmission so they can figure out why it's triggering the false positive and fix it. (If it happens with everything you compile, just sending them one will suffice.) In the meantime, you should add an exclusion to Windows Defender for the folder that you compile your executables in.

Answer 5

I ran into this after installing MinGW on 01-08-20(dd-mm-yy). For me it was also Windows Defender, the way to - hopefully temporarily- get rid of this is to add an exception for the folder your compilation output will reside in. The Microsoft website states these steps to add an exclusion:

1. Go to Start > Settings > Update & Security > Windows Security > Virus & threat protection.
2. Under Virus & threat protection settings, select Manage settings, and then under Exclusions, select Add or remove exclusions

Answer 6

I had a similar problem. I figured out that the following dll was missing: mingw32-libmingwex-dll. Once I installed it via "MinGW Installation Package", I didn't have the problem anymore. I hope this can help others.