Is there any way to tell what within a QB64 program is triggering false AV detetions?

[hanness]

I have a QB64 program that is somewhere around 16,000 lines of code. Unfortunately, to use this program, I always have to set an antivirus exception because it will end up quarantined otherwise. It's also difficult to get other people to use the program when the see it being flagged as being unsafe.

Is there any way to ascertain exactly WHAT is making the AV software think that it is unsafe? With 16,000 lines of code I have no idea what to even look for.

[2112]

I have a QB64 program that is somewhere around 16,000 lines of code. Unfortunately, to use this program, I always have to set an antivirus exception because it will end up quarantined otherwise. It's also difficult to get other people to use the program when the see it being flagged as being unsafe.

Is there any way to ascertain exactly WHAT is making the AV software think that it is unsafe? With 16,000 lines of code I have no idea what to even look for.

It must be the compiler. Years ago, in RapidQ I got false AV detections when I compiled a program. I had to use "upx ultimare packer for executables" software to uncompress the exe file and then compress it again (not nessessary) with the -1 option. Then there was no AV detection. But I don't know if upx works with 64 bit. I would change the settings in QB64 Compiler and if there was no result I would use upx.

[bplus]

Yes downloading compiled QB64 programs has become a problem for Windows users. 
Best I can offer is just zip the source code and hope user can compile code themself.

I have to say when I saw AV my first thought was Audio/Visual not AntiVirus, guess this dates me

[SpriggsySpriggs]

Does your code do anything with DLLs or things like that?

[hanness]

Does your code do anything with DLLs or things like that?

No, I don't do anything like that at all. But I do run lots of commands using the SHELL command. For example, I make frequent use of DISM in order modify Windows ISO image files. The whole idea of my program is to modify and update Windows images. For example, I can download the latest monthly updates and inject them into a Windows ISO file. Pretty much anything that you can imagine or want to do with a Windows image my program can do but it's all done by simply calling Microsoft utilities and there's no use of DLLs or anything of that sort. It's all just simple shell commands.

The attached screenshot of the main menu for the program should give a better idea of the types of things that the program can do.

[hsiangch_ong]

No, I don't do anything like that at all. But I do run lots of commands using the SHELL command. For example, I make frequent use of DISM in order modify Windows ISO image files. The whole idea of my program is to modify and update Windows images. For example, I can download the latest monthly updates and inject them into a Windows ISO file.

the antivirus detects that. then demonstrates its displeasure with it. remember microsoft is trying to include a.i. into every aspect of windows. it sounds silly. but i don't think they like the idea. of other people tampering with "their" isos.

it could be as simple as a command in qb64 like:

shell "programodify whatiswindows20250000001.iso"

and the anti-virus notices an "exec" process. related to a file which has "iso" suffix. this is because at least one cheater. tried to hack someone else's system that way. or tried to get a "free ride." to make sure he/she never had to pay for a windows license. (shrugs)

i could expect windows defender to be this clever by this time. again, this has to do with the presence of a.i. in windows11 becoming stronger and more frequent than ever.

[hsiangch_ong]

I have to say when I saw AV my first thought was Audio/Visual not AntiVirus, guess this dates me

clamav was supposed to be a singing sea shell!  but it's not.  it's an antivirus.  for the most insecure people even using linux.

https://www.clamav.net/

i also think that "av" means "audio/video."  since high school.

[SMcNeill]

Honestly, in my opinion, every OS should have a folder or drive simply called "Trusted" on it.   

C:\Trusted\   or T:\ for trusted, or whatever someone wants to set things up for.

Then, when you go to a site and you trust the software on it, you simply download it to C:\Trusted\Trusted Downloads\ and then extract it to to C:\Trusted\Programs, and the built in anti-virus never once reads/scans/or checks it for you.  YOU, as the human and owner of the PC, have declared it to be a trusted program and your anti-virus can go take a hike and pisser off.

Nothing is more of a PITA than to download a file and then have some keygen or crack which is *SUPPOSED* to be there for your pirated software to work properly, just up and quarantine even before you ever open it to start with.  Nothing is more annoying than compiling your own damn code and then having the OS quarantine it half a second after it compiles and then you'll blaming the compiler saying, "it didn't really compile"!!   Most of the anti-viruses nowadays do their own thing and they do them silently in the background, with you only finding out what's going on if you open them and check status/update/actions/whatever tab they hide it under.

Personally, I don't even have *any* anti-virus running on my machine.  Nor firewall.  My UAC settings are as low as any system will allow.  I don't want my damn PC to protect me from myself.  IF I SCREW UP LIKE AN IDIOT AND INFECT MY MACHINE, I'LL REINSTALL WINDOWS MYSELF AND FIX IT!!!  

As far as I'm concerned, false positives and unwanted quarantines, and blocking of permissions and the ability to use my own damn PC to do and run what *I* want to do and run, makes an anti-virus much more of an issue than any virus which is out there waiting for me to stumble upon it.  I simply don't download suspicious files.  If I ever do, it's always in a sandbox first, and then I wait and watch to see what happens.  I don't click those "You are the 1000th visitor to this site and win a BLAH!!" popups.  I expect to keep myself safe, any the antivirus on my machine is just more of a pain than it is a boon, and it consumes so much resources and CPU and runtime and then 99.987% of the time just gives me ISSUES to deal with instead of any real benefit...

So I just don't use any anti-virus at all. 

For everyone else, I *at least* recommend setting up your system with one safe zone for all your stuff which is never exposed to any anti-virus/firewall shenanigans.  Make a C:\Trusted folder and whitelist it.  Exempt it.   Put all your coding stuff and personal stuff that you download and trust in it.

Your life will be SOOOOO much better afterwards for it.  And if you ever *do* get a virus there....  Shrug it off and just accept that YOU were the one who trusted something like an idiot that you shouldn't have.  Learn, don't trust such things again, and reinstall windows/OS and go from there.

[hanness]

Amen! I agree with you 100%. In fact, I already do something very similar. I have a folder called my projects and I have that excluded from the antivirus software. But you actually make a really good point, and I think that I am probably going to follow your lead and kill antivirus on my machines as well. I have a highly regimented and well-planned backup scheme so if anything ever did happen to me it really would be of no great consequence. Besides I have been using Windows since the mid 1980s and have never ever once had any sort of real virus or malware. The only alerts I have ever gotten from any antivirus software have every single time been false positives.

For me the issue is not much of a problem because as I said I simply have an exclusion in place. The problem is that I have my program up on GitHub and I just hate having to post a note saying "your antivirus software may claim that this program has malware but trust me it really doesn't". As distrusting as many people are today that would right away cause them to not want to touch my program.

Thanks for the feedback I do very much appreciate it.

[doppler]

Would getting the EXE digitally signed get windows or the AV off your back ?  I have the same problem from Mcafee but I was lucky.  I made 1 line code change and bam it activated on starting.  The common thing I was also using shell commands, but nothing extra fancy.  Just using the start command to execute a dos level program.  Never got to the dos level program.  Died on just starting.  Some kind of runtime code, that the compiler never got dinged for.  Worst part Mcafee never said what it didn't like about it.

IF I SCREW UP LIKE AN IDIOT AND INFECT MY MACHINE, I'LL REINSTALL WINDOWS MYSELF AND FIX IT!!! 

@Steve look at clonezilla.org.  I have saved my self and friends many times from infections.  You can restore a drive to exactly to the day you saved it.  I do it monthly, nobody says you can't do it weekly.  The trick is to use an external drive.  Should be the size of twice a normal backup.  Old image + new image.  Best part it's a booting linux disk.  Doesn't involve using windows.  The drive can be any format for any O/S.  The drive doesn't need to be the booting drive.  I could be a data device.