False Positive Virus Detection

We get notifications about virus detection software that raises a flag on our products from time to time.

Alerts are triggered because specific program code match patterns shared by malicious code. While some anti-virus programs look at the context of the code, others are more prone to raise an alert as soon as a pattern is matched.

Because the programs sometimes use code obfuscation to protect the intellectual property, it is hard for the detection to see the context. On top of that, some viruses are distributed using the same type of obfuscation and therefore producing some of the same code patterns.

Before we release new versions of our programs, we try to scan the release candidates with as many different brands of anti-virus software as possible. We do this to change some of the code to minimize the number of triggered alerts for false positives. However, this is a moving target because the searched patterns change over time.

If you find a detection alert, you are welcome to send us information about it. We will look at it and see if we can change the code signature to prevent it in the future. This will help us improve the software over time.

Our installers are signed with digital certificates to prevent code changes. Make sure that you have checked the signature before you install it. You should generally validate the signature on everything you get via the Internet.

We do not consider it a realistic target to have zero detections across all brands of anti-virus software at all times. If only one or two brands detect something, it may be better to contact them about the triggered event.