CODEWITHSUNDEEP
cgcccodeblocksbitdefender
Ape
Ape

Reputation: 51

Fake-Positive Bit-defender problem Gen:Variant.Tedy.304469


#include <stdio.h>
#include <stdlib.h>

int compteAppels() {
    printf("hey");
return 0;
}
int main()
{
    int i, nbAppel;
    nbAppel = rand();
    for (i = 0; i < nbAppel; i++ ) {

        compteAppels();

    }

    return 0;

Bit-defender detect a threat when i compile this trivial script ( i'm on Code Blocks ) and put my file in quarantine , when i go in bitdef information about the threat it say it has been infected by "Gen:Variant.Tedy.304469"

I'm a student and beginner in C langage, I search on google "Gen:Variant.Tedy.304469" ( only 94 results lul ) i see people that may have the same issue than me but i just wanted to make sure, FYI the first time i got that issue was with a script that manipulate memory with malloc, i forgot once to deallocate so i thought it was the cause, but after i deallocate the issue was still here.

Upvotes: 5

Views: 13095

Answers (1)

Joel
Joel

Reputation: 2361

Let's parse out that name.

  • Gen - a generic detection method was used.
  • Variant - this is thought to be a variation of some known malware
  • Tedy - the name of the malware that this is thought to be
  • 304469 - an ID number assigned to this believed variation

Add an icon to your program and this is likely to go away. You can also change compiler options that affect the generation of the binary to make this go away (or cause it to be detected as a different malware title).

Because a malware author may recompile a program, binary signatures are not necessarily effective to detect variations. Virus scanners may look for other variations in a file and attempt to use those as a detection method. The downside of this is that it produces false positives. This is less of an issues for users, who are likely to be most concerned with well-known binaries, and more of an issue for developers, who produce binaries that the scanners haven't yet seen.

This can be more of a challenge if your development machine was issued by an organization or employer. They may be understandably more cautious and treat the suspicion of a threat the same way that they would treat a confirmed threat. You might be unable to instruct your scanner to ignore that specific directory or file.

If you ever want to see what the range of virus scanners will say about your executable, upload the exe to https://virustotal.com. It will scan your file against a number of different scanners and show you the results.

Upvotes: 1

Related Questions