Hi!

Using visual studio c++ 2017 for my games. I found a malware in one of my projects. Cleaned it. The folder has no malware, but when I recompile the game the new exe-file has the malware again!

I have cleaned all my harddrives from the malware (it was found on some places) but it still reappears when I recompile that project.

NOTE: I can recompile any other project, those exe files doesnt contain any malwere. It's only this one project...

For reference I found it with EMSISOFT and it calls it "Gen:Variant.Razy.441994 (B).

Im using win 10.

Thanks for any help on this strange issue!
Erik

Good ideas. I will try another software to start with. 

But shouldnt the same signature be built into other project that also build (similar exe) files though? (that would mean the other files should be marked as (false) positive as well...)

You can check against a wide range of virus scanners by uploading the suspect file to VirusTotal.com. In general a false positive is more likely to be identified as different things by different scanners, and also be marked as clean by most of them.

Assuming it is a false positive you have a few options:

1. Consider changing to a different anti virus program, especially if you're not distributing your software to other people yet. I've never had any troubles with the free one that's built into newer versions of Windows.

2. Submit a false positive report to all of the places that detect it as a virus.

3. Try to make changes to stop it from being detected. For example, switching to a different installer may help.

Uploaded it to virustotal and the file seems to have something in it.

BUT: if i recompile it in debug mode it's clean. Below is the result for the file in release mode.

Can there be something on my harddrive (hidden, i've cleaned all disks) that the AV app cannot find, but its built into the release builder somehow so it gets injected into the exe when it builds it? Or is this many false positives?

Best regards
Erik

Yes other projects' exe-files are clean even in release mode.

It's most likely to be a false positive, caused by some part of your code that is somewhat similar to some part of the virus signature. This is quite common, especially if you're doing some clever bit-twiddling and the like in your code. I've had major problems with some bioinformatics software I wrote before for similar reasons. All you can do is whitelist it for now on your computer, and report it to the virus protection vendors as a false positive.