Antivirus software always detect virus and delete .exe

[Nagi]

Hello. This is a long term problem i have with all versions of game maker and i can't find any solutions of how to solve this. For now i using last updated by stable channel version of game maker studio (free license)

Every time i create an executable, standalone or packed by zip, or if i make an instalation package of my project, my antivirus will say that this is a virus and will delete .exe.
I tried it on different mainstream av (norton, kaspersky and avira) and the situation is always the same. I tried it on different platform (my desktop and notebook). And i tried it few years before with another PC. The same.

So next what is real problem, the same behaviour presented on PC of all my friends who tried to test this.

I constantly tried to look for any way to solve this, but everytime i found something related to this issue, people just saying: relax, this is false positive reaction of AV.

But how can i relax, if no one can run my executable and any av will delete it?? And i just created simple project with room and a few sprites. So are there really a way to stop AV for deleting my executables?

And then what i dont understand yet, is how do developers that post their projects made with GM on steam avoid this problem? Can anyone help me to understand why other people .exe are not detected as viruses with any AV, but it happen with my executables?

Simply question is: what should i do to stop any AV for any PC to detect my .exe compiled by GM as virus software?

---> I know thing about false positive. BUT I can't ask every person using AV to delete this AV so deleting my antivirus will not solve the problem. <----

[Daynar]

Are you using any extensions or addons? Some of those can cause this behavior. If not my guess would be that it's seeing an unknown publisher and deleting it. However you should be able to open your antivirus and see why it deleted it (it should give something more specific than MALWARE DETECTED) and then use that to figure out how you can fix the issue.

[Nagi]

Originalmente postado por Daynar:

Are you using any extensions or addons? Some of those can cause this behavior. If not my guess would be that it's seeing an unknown publisher and deleting it. However you should be able to open your antivirus and see why it deleted it (it should give something more specific than MALWARE DETECTED) and then use that to figure out how you can fix the issue.

i dont use any addons or extensions (as i wrote i made a simple project specially for that).
I tried to see what Av saying and it says its TR.Dropper. Which means that is trojan.
Doesnt have any clue why its related only to game maker exe cause its never found anything like that in compiled C# or Java binaries on any other of my computers before. Just GM exe.

[Daynar]

It looks like avira commonly has false positives related to TR.Dropper. IDK if that's the antivirus you're using, but the solutions there seeemed to be updated the antivirus software and if that doesnt fix it report the false positive. If you don't ahve any updates you could also try switching to a beta version of GM:S and see if that fixes it.

[Nagi]

As i wrote before, sadly, i can't ask any user of avira to set my executable as exception. And that is not only avira problem, its any AV problem. Its not a question how to fix this on my PC. Im absolutely fine with setting up exception for each my executable and keeping av alive.

But its about how to make all other PC with antivirus stop deleting exe files made by my gm compiler...

And i think, a lot of people who do compile their projects, have AV instilled somehow. But why this problem of mine occurs not for everyone? What is the difference...

[Daynar]

Have you tried downloading a gamemaker exe made by someone else and seeing if the AV deletes it as well? If it does then there might not be much you can do in gamemaker alone to fix it. But here are a few things in gamemaker you could try to fix it, exporting an installer, using a beta or early access version of gamemaker, using a different export module all together. Aside from that i don't know what you could do in gamemaker that might fix the issue.

[Nagi]

Originalmente postado por Daynar:

exporting an installer, using a beta or early access version of gamemaker, using a different export module all together.

The problems persisted on early build of GM:S from 2 years ago with norton AV...so i guess thats not a problem.
I tried beta channel, still the same problem, so unfortunately...

But how can i use a different export module?

[Daynar]

Olick on the Target: dropdown button[docs.yoyogames.com] and choose a different target. This is a bad workaround since it generally means exporting it to a different platform and the game may not work the same and there may be extra steps needed in setting it up. If you have it I'd try exporting to html5 as that shouldn't have any antivirus issues and be easily-ish accessable to your friends.

Your best bet though is to submit a ticket to yoyo (and then they'll tell you to head on over to your antivirus provider most likely) and submit a ticket to your antivirus provider. This is very likely beyond what people here are capable of fixing.

[._.Stashed Girl._.]

Hello morena, it's the same stuff with some .exe that use some extension in the software Clickteam Fusion 2.5 (Steam version or not).

For being *zen* I just tell to my AntiVirus (Kaspersky), that ALL the folder, files, subfolders where Clickteam Fusion 2.5 is installed to IGNORE when encountering a "malware, virus or any other false detection.."

I therefore ALWAYS scan files in a temp folder (Kaspersky and VirusTotal website are helpful for scan) outside folder of Clickteam Fusion 2.5 when it comes from INTERNET/EMAIL or any external sources suchs from Extension Manager that use Internet for download files..
If files are clean, I move them in Clickteam Fusion 2.5 for being usable within !
(so as it, Kaspersky don't bother me IF it is a false-positive virus detection)

Also, as long I know that is a false detection, I submit the file to their Kaspersky Lab servers so they can fix that false-positive detection in a future update of their Virus Database Definition.

Hope it's helped.

Have fun with GameMaker.


PS: GameMaker don't bother me with false-positive detection, only Clickteam Fusion 2.5..

[sentient]

Never had issues with Kaspersky Pure 3, Kaspersky Total Security, or any triggers with any other protection software whatsoever. My only guess would be that something - either the games you're making, or any addons/extra, whether reputable or not - are trying to do something it probably shouldn't be doing... Reading/writing files with admin rights/running other code/programs? or trying to access system files? I haven't a clue, only a guess, there's lots of possibilities...

[Nagi]

Originalmente postado por ≼ƧƹƞƮ℩ƹƝƬ≽:

My only guess would be that something - either the games you're making, or any addons/extra, whether reputable or not - are trying to do something it probably shouldn't be doing... Reading/writing files with admin rights/running other code/programs? or trying to access system files?

As i said, i did simple projects with 1 sprite and 1 room to test that. I triple checked any extensions and dll, but no. Nothing more in my project than loading a few resources and trying to show 1 simple room.

[Nagi]

Originalmente postado por Aтαηα¢ιυѕ:

Hello morena, it's the same stuff with some .exe that use some extension in the software Clickteam Fusion 2.5 (Steam version or not).

For being *zen* I just tell to my AntiVirus (Kaspersky), that ALL the folder, files, subfolders where Clickteam Fusion 2.5 is installed to IGNORE when encountering a "malware, virus or any other false detection.."

Sadly, i dont use any extensions in GM and problem mostly not my computer, but others... Can't ask other users to "ignore" my false-positive detected .exe. Also, i can't imagine i will send all builds of my .exe to avira or norton team to fix this problem. I need to solve it systematicaly...

[._.Stashed Girl._.]

Originalmente postado por morena:

Originalmente postado por Aтαηα¢ιυѕ:

Hello morena, it's the same stuff with some .exe that use some extension in the software Clickteam Fusion 2.5 (Steam version or not).

For being *zen* I just tell to my AntiVirus (Kaspersky), that ALL the folder, files, subfolders where Clickteam Fusion 2.5 is installed to IGNORE when encountering a "malware, virus or any other false detection.."

Sadly, i dont use any extensions in GM and problem mostly not my computer, but others... Can't ask other users to "ignore" my false-positive detected .exe. Also, i can't imagine i will send all builds of my .exe to avira or norton team to fix this problem. I need to solve it systematicaly...

Why don't set a "RULE" for ignore "virus" from a specific build folder ?

Anyway, disable your AntiVirus.
And POST the file on VirusTotal.com website, so, wait for the report.
Once the report is done you will be see if ANY others ANTIVIRUS detect your .exe as a malware.

The cool fact with VirusTotal is its ability to multi-scan ONE file with a bundl of 30+ AntiVirus !
Report which is detected, and by what.
On top of that, it can also get the "HEADER" PE code of any .exe/.dll sometimes it is full of really great interesting informations !

Just try it.

[Nagi]

Originalmente postado por Aтαηα¢ιυѕ:

Originalmente postado por morena:

Sadly, i dont use any extensions in GM and problem mostly not my computer, but others... Can't ask other users to "ignore" my false-positive detected .exe. Also, i can't imagine i will send all builds of my .exe to avira or norton team to fix this problem. I need to solve it systematicaly...

Why don't set a "RULE" for ignore "virus" from a specific build folder ?

Anyway, disable your AntiVirus.
And POST the file on VirusTotal.com website, so, wait for the report.
Once the report is done you will be see if ANY others ANTIVIRUS detect your .exe as a malware.

The cool fact with VirusTotal is its ability to multi-scan ONE file with a bundl of 30+ AntiVirus !
Report which is detected, and by what.
On top of that, it can also get the "HEADER" PE code of any .exe/.dll sometimes it is full of really great interesting informations !

Just try it.

Looks like you really haven't read any of my post, or just didn't wanted to answer by topic.

1) AS I SAID MORE THEN ONCE, EVEN IF I DISABLE OR DELETE MY ANTIVIRUS, ANY OTHER USER ANTIVIRUS THAT THEY HAVE ON THEIR PC WILL STILL DETECT MY GAME AS TROJAN. AND AS I SAID, THIS BEHAVIOUR WAS TESTED ON OTHER PC. SO WHATS THE POINT TO ADD MY EXE TO EXCEPTIONS OF MY AV, IF I CAN NOT ASK TO DO THIS ANY RANDOM PEOPLE WHO WILL TRY MY BUILD???? I DONT CARE IF ITS FALSE-POSITIVE, I DON'T CARE IF ITS ONLY MY ANITVIRUS, I NEED A FIX SO MY EXE WILL NOT BE DETECTED AS TROJAN ON OTHER USER PC NO MATTER WHAT AV THIS RANDOM USER IS USING,WHY DONT YOU GET IT?

2) as i said, i tested this with 3 antiviruses, so i know that 3 mainstream antivirus do the same with my .exe, why do i need virus total if its already enough?

AND I DONT USE DLL OR EXTENSIONS, I M HAVING PROBLEMS WITH JUST SIMPLE PROJECT WITHOUT ANY EXTENSIONS COMPILED.


Sorry for capital letters, but really, how esle can write so people stop repeating the same thing about deleting or deactivating my antivirus??? the question is NOT ABOUT THAT.

[Nagi]

I tried virus total service, so what interesting is that my submitted exe wasnt recognized by avira on this site as a virus, but my personal avira do recognize it as trojan.
Whi is more interesting, no reaction from symantec, whic also have previously detected my .exe as trojan.
So i making a conclusion that this service can not be trusted or help me to solve problem cause its actually have different behaviour from what actual AV installed on local machine have.

[JT]

I, too, love it when heuristics picks up my newly created exe as something strange simply because it's never seen it before.

If you ran an actual scan on it, I don't think it would pick up anything anyways