How do I prevent my game from being detected as a virus?

Question

I developed my own game engine and I'll refer to it as a Software Development Kit (SDK) here, for making a specific type of game.

The SDK encapsulates low level DirectX APIs. It's written in C++ and compiled on its own using Visual Studio 2019 which generates a static library file.

Under the Visual Studio 2019 compiler/debugger with remote debugging tools, I can compile, link and deploy a debug sample application to another computer and continue my development activities.

However, when I copy all the graphics files and the executable to a standalone computer (running antivirus software) and then run my sample application, the antivirus software detects my application as a virus and will go so far as to delete it from my computer.

It does so before I get so far as to change video resolution. I am running Windows 10.

This is now of concern because I would like to use the sample to solicit friends and to gauge interest in collaborating with me on a small gaming project. The sample is simply a means to test artwork by seeing it animated, so that a graphic artist can work independently with his/her own tool. They would simply have the sample application and an artwork compiler as well.

I read in another post that is several years old entitled “Conundrum with quality and virus reports: is our game releasable?“, in which the author had similar issues.

In that post it was recommended that the antivirus vendors should be contacted, in hopes that the problem would be corrected before they released their product.

Is this really the best course of action? Does anyone know how my application got into the database used by the antivirus vendor? When I contacted the vendor the analyst whom I spoke with suggested to turn the antivirus software off.

I am trying to prevent the possibility of releasing something I worked hard at, only to have it be detected as a virus after release. Is this preventable and avoidable?

Windows Protected you PC Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk

More Info.

App: Buzz.exe Publisher: Unknown Publisher

Run Anyway or Don't Run

I select Run Anyway

---

Down Load Insight Our information on this file is inconclusive. We recommend not using this file unless you know it is safe.

Very Few Users Fewer than 5 users in the NXXXXn Community have use this file.

Buzz.exe Downloaded from http://codeload.github.com/david-harding/

Very New

File was relead less than 1 week ago

Unproven

There is not enough information about this file to recommend it.

1. Stop this program from running.
2. Remove this file from the system (recommended).
3. Run this program anyway.

More details.

File Insight

1. Details a. Developers Not available b. Version Not Available c. Identified 2/11/2021 at 4:14:23 am d. Last used 2/11/2021 at 4:21:46 am e. Startup item No

2. Origin a. https://codeload.github.com/david-harding/sample/zip/main b. Downloaded file buzz from github.com c. File Created Buzz.exe

More Info Taked me to the AV web site to rate the binary

Click 3. Run this program anyway.

Program runs normally.

++++ I am now using only a release version of my sample executable and the original reported issue has not gone away. The problem is chronic. I am not able to unzip the file downloaded from GitHub on my development computer, the AV software removes the .exe file immediately. I have not done exhaustive testing with USB devices etc. The message above indicates that the file is not trusted.

I am going to digitally sign my sample file with a certificate that is trusted by a trust provider. If the certificate is not too expensive. I tested with a sample PFX, which is included in VS 2019.

I found the following article useful. https://docs.microsoft.com/en-us/dotnet/framework/tools/signtool-exe#sign If anyone has any suggestions on ordering a PFX cert, I would appreciate suggestions. It looks like that is what is needed here. I will report back when this issue is resolved. Thanks for everything so far.

Answer 1

The short answer is that the issue I had originally reported with my game being detected as a virus is resolved. I obtained a code signing certificate, from a trusted root certificate authority. Not a PFX certificate, like I had originally thought was necessary. I am afraid I will not be going into too many specific details regarding my individual case. The reason for not being forthcoming is due to not having been granted permission to discuss the process by the vendors. And obtaining a code signing certificate may be different for individual cases and vendors. But I can say that the process took a few months. And not due to anyone or any organization not doing their part. The process just takes a few months. The most important part of the process is to be properly scrutinized to insure you are doing legitimate software development work. The basic steps I performed are as follows:

1. Secure a software reseller, for the purpose of obtaining a code signing certificate, NOT a PFX certificate that I would install on a web server. This took a lot of calling around. And my hat is off to the reseller that was willing to work with me, since I was not an established client, and the commission was probably not extremely high, given the duration. They will certainly get all my future business.
2. Establish a legitimate business.
3. Establish my business presence with a web site, and company email address.
4. Register my business with several well know business registers on the Internet.

For smaller game studios such as mine, I recommend you perform above steps 2,3, and 4 before 1. I am sure I caused confusion because I was asking the reseller for a PFX certificate but had described the problem statement as one in which I wanted to digitally sign binary files. In conclusion, now when I display the file properties of my windows binary by right clicking the file, I now have the all too familiar “Digital Signatures” tab, which indicates the file has been signed. Now I have a lot to read on securing my private key and token, essential security hygiene. Thank you to all who will go nameless, your truly awesome.