18

I have created a C# program and I recently noticed that when I merge my referenced .dlls into one executable .exe file using IL Merge, my Anti Virus (Avast) immediately deletes it and says that it's a virus. I always make lots of back ups so I tested the same thing with a back up from 2 days ago and I didn't experience this problem.

So I deleted my recent code line by line and noticed what is triggering the program to be detected as a virus. I have a void where I check if a list of files exist in a specified path (in my apps folder located in %appdata%). The void has around 8 File.Exists(path) commands and removing these 8 lines my program is no longer detected as a virus.

So my question is , is there any solution to this problem ? Why is my program detected as a virus just because i'm using File.Exists ?

6
  • 2
    A similar question was deleted, so I would copy my comment from there: I don't think there can be a definite or lasting answer given the nature of heuristics. Yes, File.Exists(path) could set it off, but we can't know for sure; yes, it would be an example of naive heuristics and it could change in a next release. False positives happen, what you can do about it is submit your app as a false positive to the vendor.
    – GSerg
    Dec 4, 2016 at 15:55
  • In this example it's definitely 'File.Exists(path)' setting it off because I kept all the other code the same.
    – Harry
    Dec 4, 2016 at 15:58
  • 3
    In theory you could use their "report false positive" form to send your app so that it is no longer reported avast.com/false-positive-file-form.php In practice, your request could just be ignored and you will suffer what other suffer too - Avast has one of the largest number of false positives reported. Dec 4, 2016 at 16:01
  • 1
    The problem is. This will be my first application I will publish. If people see that a virus is triggered (regardless of a false positive) I will lose my legitimacy. I don't want people thinking they have downloaded something unsafe.
    – Harry
    Dec 4, 2016 at 16:04
  • 3
    I think its not code File.Exists, its what your program is accessing the app data folder, different path will not show as a virus
    – user1599615
    Dec 14, 2016 at 18:49

3 Answers 3

17

Have you provided an AssemblyInfo.cs with at least the "name, author and description" field (not the default values)? I had a similar issue about 1 year ago and this solved the problem for me.

2
  • 2
    Unfortunately that didn't work for me. Thanks for your input tho.
    – Harry
    Dec 28, 2016 at 1:34
  • 5
    Adding values for Title, Description, Company, Product, and GUID to AssemblyInfo solved the problem for me. Oct 24, 2019 at 16:16
9

Please change the "Guid" in AssemblyInfo.cs a little, then try again.

That worked for me.

0

I suggest using GUID.one to generate a new GUID for your program. For me only this escaped the Windows Defender detection, as when I tried changing the GUID manually, it got detected as Behavior:Win32/DefenseEvasion.A!ml. You can change the GUID in the Assembly Information of your project. Hope this helped!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.