Executables like virus

[Fabrizio_F_]

Hi,

I compile with success my code with Intel Visual Fortran and i used it without problem.

But when i send my exe to a friend his antivirus identify it as a virus.

How is it possible? Is there anything i can do to fix the problem?

Thanks in advance

Fabrizio

[FortranFan]

Fabrizio F. wrote:

..

But when i send my exe to a friend his antivirus identify it as a virus.

..

How're you sending the executable to your friend?  If in an e-mail, you should try to use utilities like WinZip or 7-Zip or even Windows compressed zip  folder option to zip the program files and then e-mail the zip file over to your friend.  On some e-mail systems, you may have to encrypt the zip file contents and password-protect the zip file also.

[Fabrizio_F_]

Hi,

we don't have problems with the e-mail system but with the exe file.

We also try to scan the exe with VirusTotal, and 8/40 antivir indentify it as suspicious file...

Any idea?

Thanks

Fabri

[FortranFan]

I assume you've a regular executable created with a Fortran main program that doesn't include any detailed manifest information including program certification, etc.  If so, my hunch is the anti-virus utility is simply providing a default warning since it doesn't find any such details and it cannot verify any credentials of the provider of the executable (that's you).  I'd think it would do the same for any similar executable whether they were created using C, C++, Visual Basic, C#, etc.  That is, it probably has nothing to do with Fortran or the Intel compiler.

[Steven_L_Intel1]

A lot of AV programs automatically distrust "new" executables. Which AV program does your friend use and which virus did it claim the EXE had?

[GVautier]

Hello

Beware of "heuristic" search mode of some AV softwares. They search for predefined bytes sequences that are presumed suspicious in whole files (code and data). It can append that a safe code (or data) may content such a sequence.

It append to me in a pure data dll, in a old executable of MASM samples and even last week in excel 97.

Try to deactivate the "heuristic" mode and re test the file.

[bmchenry]

if you are sending to a friend or colleague you first should NEVER send as an EXE file. Most email servers and anti-virus programs will not allow that to happen. For sending i normally simply zip it, rename the zip suffix 'zippy' and then send out. (zip files also sometimes get tagged as 'suspicious' and so sending zip files has issues too)the friend/colleague then renames the file suffix 'zip' unzips it and you should be good to go (if their anti-virus program complains but will let run)

if you are marketing/posting up programs on the web you'll run into the 'Sonar' complex: We first encountered it with Norton Sonar, see http://www.mchenrysoftware.com/board/viewtopic.php?f=17&t=515 and most other anti-virus vendors use similar approaches..the 'if we don't know the software vendor, we will tag is as suspicious' complex.

The best way around it is to digitally sign your program. very simple and easy (I finally gave in after encountering too many of my clients encountering issues) There are many folks who market digigtal signing certificates

Does INTEL market one?

Then for efficiency you can put as a custom build step as it only requires running a post compilation step.

[Steven_L_Intel1]

Intel does not sell digital signing certificates. While I agree that most AV programs give more trust to signed executables, this is probably expensive overkill for all but commercial developers.

[bmchenry]

code signing isn't that bad for individuals and small to medium software companies. Anywhere form $50 to $300 per year depending on who you buy the software from and whether you buy for 1 or more years. Be sure to shop before you buy! The main reason and benefit i went to the trouble of getting digital signing is that then my clients and others don't have to deal with anti Virus programs making folks do 'stupid pet tricks' ...maybe call it 'stupid binary prophylactic tricks' to get your unsigned software to run on other machines.

[Bernard]

As @gvautier said it could some sentence of opcodes which triggered false positive while being disassembled by AV scanning engine.