简易闹钟程序被杀毒软件判定为恶意软件的原因咨询

Let’s break down why your simple alarm program is triggering antivirus detections, even when you remove the volume-adjustment loop. First, here’s your code for reference:

FMOD_SYSTEM* sound;
FMOD_SOUND* son;
FMOD_System_Create(&sound);
FMOD_System_Init(sound, 32, FMOD_INIT_NORMAL, NULL);
FMOD_System_CreateSound(sound, "alarm.mp3", FMOD_CREATESAMPLE, 0, &son);

SYSTEMTIME time;
GetSystemTime(&time);
while (!(time.wHour==16 && time.wDayOfWeek==4)) {
    Sleep(10000);
    GetSystemTime(&time);
}

FMOD_System_PlaySound(sound, son, NULL, 0, NULL);

// Volume adjustment loop (removed in test version)
for (int i = 0; i < 100; i++) {
    INPUT ip = { 0 };
    ip.type = INPUT_KEYBOARD;
    ip.ki.wVk = VK_VOLUME_UP;
    SendInput(1, &ip, sizeof(INPUT));
    ip.ki.dwFlags = KEYEVENTF_KEYUP;
    SendInput(1, &ip, sizeof(INPUT));
}

Key Reasons for False Positives #

• Startup Folder Persistence: Placing an unsigned executable in the Startup folder to run on login is a common tactic malware uses to maintain persistence. Antivirus tools flag this behavior because it’s a classic sign of unwanted software trying to stay on the system without explicit user consent.
• Heuristic Detection of FMOD Usage: Direct calls to FMOD’s low-level audio functions can trigger heuristic alerts. Some malware repurposes audio libraries for suspicious tasks (like hiding data in audio streams), so antivirus tools may flag any unsigned program using such libraries in a background context.
• Long-Running Background Loop: The while loop that sleeps and checks the system time creates a persistent background process. Malware often runs long-lived background processes to operate undetected, so this pattern raises red flags for heuristic scanners.
• Unsigned Executable: Without a valid digital signature—even a self-signed one—antivirus tools have no way to verify the program’s origin. Unsigned software is inherently more suspicious, as it can’t be traced back to a trusted developer.
• Time-Triggered Action: Waiting for a specific time to execute its core function (playing sound) mirrors behavior some malware uses to avoid detection during routine scans, making this pattern look suspicious to heuristic filters.

Fixes to Reduce False Positives #

• Sign Your Executable: Even a self-signed certificate can help reduce false positives, as it gives antivirus tools a way to recognize repeated runs of your program. For better trust, consider getting a code-signing certificate from a trusted authority.
• Use Task Scheduler Instead of Startup Folder: Instead of placing the app in Startup, use Windows Task Scheduler to run it on login. Task Scheduler is a legitimate automation tool, and antivirus tools are far less likely to flag programs launched this way.
• Replace the Infinite Loop with a Timer: Swap the Sleep() loop with a Windows timer (like SetTimer()) to check the time at intervals. This makes your app’s behavior align with standard Windows applications and less suspicious to scanners.
• Submit False Positives to Antivirus Vendors: Both Avast and Bitdefender have portals where you can submit your executable for review and request it be removed from their threat lists. Be sure to include a clear description of your app’s purpose.

内容的提问来源于stack exchange，提问作者JuanGM