Compiled C executable is detected as a virus by windows defender

user_13603774 0
Viewed 14818

I had compiled a simple hello world program in C with the MinGW compiler using the command line. As it had finished compiling, windows defender popped up and detected a virus (Trojan:Win32/Fuery.C!cl).

#include <stdio.h>
#include <stdlib.h>
int main() {
    printf("Hello World");
    return 0;
}

https://imgur.com/a/05yDjw5

I had taken action on this (Removed) as windows defender suggested, but when I compile again the same happened, multiple times.

I had downloaded an AntiVirus (Malwarebytes) and scanned my whole system and it detected some registry key errors, but not this.

I've tried compiling C++ files too, but windows defender did not detect any virus there. This only happens when I compile in C.

I've also tried checking the compiled executable at VirusTotal. https://www.virustotal.com/gui/file/476d47215dad80db49c9fd508ab5e10e5aeb5b623248ca156830a28b70affe5f/detection

I tried CodeBlock's MinGW compiler and 0 engines detected it. (Same C file) https://www.virustotal.com/gui/file/8ba4b0fa24b1b6b69152acce2353fcca8447bbecbfc4e5ec48d33cc75d94f2f1/detection

EDIT: I deleted the path variable of C:/MinGW and added CodeBlock's MinGW compiler. I then used the command line to compile the same C file again and had uploaded the .exe file to VirusTotal. This time, 0 engines detected. So I have come to the conclusion that, the MinGW compiler that I had installed was creating this problem. https://www.virustotal.com/gui/file/34d383f6c09f897d8c9a44ed0e7850574320e50fdf439eeb1f06705fdcc95386/detection

I don't know why this happens. Is there a malware in my computer that affects my C programs or is this a false detection?

c c++
6 Answers

There is no malware, it is a false positive. The executable generated by your version of MinGW looks very similar to a particular virus.

To avoid the problem, add the directory where you build your code to the list of exclusion in the antivirus.

Also consider using mingw-w64 instead of mingw.org .

user_15059390

I may have solved my problem.

This is what I did: I removed the PATH Variable of C:\MinGW and added CodeBlock's MinGW compiler (CodeBlocks/MinGW/bin). I used the command line to compile the same C file, and had uploaded the .exe to VirusTotal. No engines detected this file! https://www.virustotal.com/gui/file/34d383f6c09f897d8c9a44ed0e7850574320e50fdf439eeb1f06705fdcc95386/detection

So I have come to a conclusion that, MinGW was the compiler that was causing this problem. I have removed it.

However, I am not quite sure if this problem is FULLY solved. There is still a possibility of malware affecting my executable (or perhaps not). I cannot be sure.

If anyone has any answers, please comment or answer

user_136037740

I came across with the same problem, compiler tdm gcc v9.2.

The following compilation triggers a warning (kaspersky).

gcc temp.c -o temp.exe

The following does not

gcc -O3 temp.c -o temp.exe

Where temp.c is

#include <stdlib.h>
#include <stdio.h>
#include <math.h>
int main() {
    int a, b;
    scanf("%d %d", &a, &b);
    printf("mod %4d, %4d is %4d\n", a, b, a%b);
    return 0;
}

The same code with g++ passes the test with both compilations. The antivirus software does not detect the same virus elsewhere but only in temp.exe (first compilation).

user_72010480

I ran into this after installing MinGW on 01-08-20(dd-mm-yy). For me it was also Windows Defender, the way to - hopefully temporarily- get rid of this is to add an exception for the folder your compilation output will reside in. The Microsoft website states these steps to add an exclusion:

  1. Go to Start > Settings > Update & Security > Windows Security > Virus & threat protection.
  2. Under Virus & threat protection settings, select Manage settings, and then under Exclusions, select Add or remove exclusions
user_56126910

Since you wrote that program and you know it isn't actually a Trojan, it's obviously a false positive. You should submit the file to them at https://www.microsoft.com/wdsi/filesubmission so they can figure out why it's triggering the false positive and fix it. (If it happens with everything you compile, just sending them one will suffice.) In the meantime, you should add an exclusion to Windows Defender for the folder that you compile your executables in.

user_75090650

Your system is badly infected. Since your system is basically in hands of malware writers at this point, whatever you do with your little .exe is immaterial. You don't show a minimal example. All you need is a .c file with a single line: int main() {}. You can compile it on another (uninfected) computer, copy it to yours and it'll immediately become infected. You don't have control over what gets written to that executable. It so happens that the executable is infected the moment it hits the filesystem. The malware you have does that.

Make a backup of data files that excludes anything executable, then wipe your system, reinstall Windows, install applications from credible sources (fresh downloads from trusted sites), install all Windows updates, run a virus scan of your backup using Windows built-in antimalware solution, then restore the backup. At this point your system is done, and I wouldn't trust the ability of Malwarebytes to clean it up. It's most likely to give you a false sense of security and just end up wasting lots of time, and you'll end up having to wipe everything clean anyway. So why waste time - do it right the first time.

And don't install any other antivirus or "cleaner" solution - you clearly have no feel for what's legit, and that's what got you into this trouble most likely. 99.9% of search results for malware removal and cleaner utilities are themselves either malicious malware or at least junkware that doesn't help and just extorts payments. If your online behaviors are reasonable, you won't need any solution other than what Windows includes by default.

user_13296520
Related