Prevent self-developed software from being diagnosed as a virus

[Chau Chun]

Let me describe my situation, I develop some accounting software of VB winform to use, normaly my software will modify registry to set offcie trusted location and whether the user who reads in registry has admin authority. However, I found here that it is no problem for VirusTotal to scan my exe on the first day after I developed the software. But after a few days, VirusTotal will appear and say that my exe is a virus,this makes my exe in the another computer antivirus detect as a virus, even if I run scaning on VirusTotal on the first day.

1. Why is it not a virus on the first day, but later diagnosed as a virus?
2. Is reading registry or modifying registry the cause of the diagnosed virus?
3. Any documentation or any behavior that is not allowed?
4. What can be done to avoid this problem other than to file a false positives list after it is detected as a virus

 

[Andy Ful]

Let me describe my situation, I develop some accounting software of VB winform to use, normaly my software will modify registry to set offcie trusted location and whether the user who reads in registry has admin authority. However, I found here that it is no problem for VirusTotal to scan my exe on the first day after I developed the software. But after a few days, VirusTotal will appear and say that my exe is a virus,this makes my exe in the another computer antivirus detect as a virus, even if I run scaning on VirusTotal on the first day.

1. Why is it not a virus on the first day, but later diagnosed as a virus?
2. Is reading registry or modifying registry the cause of the diagnosed virus?
3. Any documentation or any behavior that is not allowed?
4. What can be done to avoid this problem other than to file a false positives list after it is detected as a virus

That is normal. You have to upload your installer and executables to AV vendors and ask for whitelisting. For example:

Submit a file for malware analysis - Microsoft Security Intelligence

Submit suspected malware or incorrectly detected files for analysis. Submitted files will be added to or removed from antimalware definitions based on the analysis results.

www.microsoft.com

Whitelist program registration Form

www.avast.com

Report a Suspected Erroneous Detection (False Positive)

Report a false positive, false alarm, false ID, or dispute an incorrect, bad, or erroneous detection in a Symantec or Norton product.

submit.symantec.com

There was a mail method for Emsisift:
fp@emsisoft.com