1
\$\begingroup\$

I developed my own game engine and I'll refer to it as a Software Development Kit (SDK) here, for making a specific type of game.

The SDK encapsulates low level DirectX APIs. It's written in C++ and compiled on its own using Visual Studio 2019 which generates a static library file.

Under the Visual Studio 2019 compiler/debugger with remote debugging tools, I can compile, link and deploy a debug sample application to another computer and continue my development activities.

However, when I copy all the graphics files and the executable to a standalone computer (running antivirus software) and then run my sample application, the antivirus software detects my application as a virus and will go so far as to delete it from my computer.

It does so before I get so far as to change video resolution. I am running Windows 10.

This is now of concern because I would like to use the sample to solicit friends and to gauge interest in collaborating with me on a small gaming project. The sample is simply a means to test artwork by seeing it animated, so that a graphic artist can work independently with his/her own tool. They would simply have the sample application and an artwork compiler as well.

I read in another post that is several years old entitled “Conundrum with quality and virus reports: is our game releasable?“, in which the author had similar issues.

In that post it was recommended that the antivirus vendors should be contacted, in hopes that the problem would be corrected before they released their product.

Is this really the best course of action? Does anyone know how my application got into the database used by the antivirus vendor? When I contacted the vendor the analyst whom I spoke with suggested to turn the antivirus software off.

I am trying to prevent the possibility of releasing something I worked hard at, only to have it be detected as a virus after release. Is this preventable and avoidable?

Windows Protected you PC Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk

More Info.

App: Buzz.exe Publisher: Unknown Publisher

Run Anyway or Don't Run

I select Run Anyway


Down Load Insight Our information on this file is inconclusive. We recommend not using this file unless you know it is safe.

Very Few Users Fewer than 5 users in the NXXXXn Community have use this file.

Buzz.exe Downloaded from http://codeload.github.com/david-harding/

Very New

File was relead less than 1 week ago

Unproven

There is not enough information about this file to recommend it.

  1. Stop this program from running.
  2. Remove this file from the system (recommended).
  3. Run this program anyway.

More details.

File Insight

  1. Details a. Developers Not available b. Version Not Available c. Identified 2/11/2021 at 4:14:23 am d. Last used 2/11/2021 at 4:21:46 am e. Startup item No

  2. Origin a. https://codeload.github.com/david-harding/sample/zip/main b. Downloaded file buzz from github.com c. File Created Buzz.exe

More Info Taked me to the AV web site to rate the binary

Click 3. Run this program anyway.

Program runs normally.

++++ I am now using only a release version of my sample executable and the original reported issue has not gone away. The problem is chronic. I am not able to unzip the file downloaded from GitHub on my development computer, the AV software removes the .exe file immediately. I have not done exhaustive testing with USB devices etc. The message above indicates that the file is not trusted.

I am going to digitally sign my sample file with a certificate that is trusted by a trust provider. If the certificate is not too expensive. I tested with a sample PFX, which is included in VS 2019.

I found the following article useful. https://docs.microsoft.com/en-us/dotnet/framework/tools/signtool-exe#sign If anyone has any suggestions on ordering a PFX cert, I would appreciate suggestions. It looks like that is what is needed here. I will report back when this issue is resolved. Thanks for everything so far.

\$\endgroup\$
12
  • 1
    \$\begingroup\$ "Anyone know how my application got into the database used by the antivirus vendor?" Has nothing to do with that. The AV is detecting something that your executable is doing, that it doesn't like. That is, its threat detection algorithm is being triggered. The only question is, what causes your software to trigger it, and why? \$\endgroup\$
    – Engineer
    Feb 11 at 7:20
  • 2
    \$\begingroup\$ It's been a few years since I've messed with it but it may not be the "low-level DirectX APIs" or anything else specific to your code which is causing the problem, but the debug build which includes remote debugging hooks. Have you tried turning that off and/or distributing a release build? \$\endgroup\$
    – A C
    Feb 11 at 9:58
  • 3
    \$\begingroup\$ Can you tell us more about what different AV softwares say why they block your game executable? Usually they should tell you what virus signature or heuristic rule triggered the detection. That should give you a hint about what might be wrong with your executable. \$\endgroup\$
    – Philipp
    Feb 11 at 11:49
  • 3
    \$\begingroup\$ Have you looked into code signing? This is one marker of trust that's commonly used to decide what downloaded executables to block. \$\endgroup\$
    – DMGregory
    Feb 11 at 13:03
  • 1
    \$\begingroup\$ @DHarding Should you be able to find and fix the problem on your own, then please remember to post a self-answer so others can benefit from your research. \$\endgroup\$
    – Philipp
    Feb 11 at 13:08
1
\$\begingroup\$

The short answer is that the issue I had originally reported with my game being detected as a virus is resolved. I obtained a code signing certificate, from a trusted root certificate authority. Not a PFX certificate, like I had originally thought was necessary. I am afraid I will not be going into too many specific details regarding my individual case. The reason for not being forthcoming is due to not having been granted permission to discuss the process by the vendors. And obtaining a code signing certificate may be different for individual cases and vendors. But I can say that the process took a few months. And not due to anyone or any organization not doing their part. The process just takes a few months. The most important part of the process is to be properly scrutinized to insure you are doing legitimate software development work. The basic steps I performed are as follows:

  1. Secure a software reseller, for the purpose of obtaining a code signing certificate, NOT a PFX certificate that I would install on a web server. This took a lot of calling around. And my hat is off to the reseller that was willing to work with me, since I was not an established client, and the commission was probably not extremely high, given the duration. They will certainly get all my future business.
  2. Establish a legitimate business.
  3. Establish my business presence with a web site, and company email address.
  4. Register my business with several well know business registers on the Internet.

For smaller game studios such as mine, I recommend you perform above steps 2,3, and 4 before 1. I am sure I caused confusion because I was asking the reseller for a PFX certificate but had described the problem statement as one in which I wanted to digitally sign binary files. In conclusion, now when I display the file properties of my windows binary by right clicking the file, I now have the all too familiar “Digital Signatures” tab, which indicates the file has been signed. Now I have a lot to read on securing my private key and token, essential security hygiene. Thank you to all who will go nameless, your truly awesome.

\$\endgroup\$
1
  • \$\begingroup\$ I have not run into this problem again since signing the binaries. \$\endgroup\$
    – DHarding
    May 15 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.