<p>As you may know, I&#8217;m developing SoundSwitch in my free time. Lately, it&#8217;s been struck as a Trojan by Kaspersky. This happens just a couple of month after Symantec did the same with Norton. Moreover, it was at the same time that it was featured on <a href="https://www.howtogeek.com/301290/how-to-switch-windows-sound-outputs-with-a-hotkey/">How to Geek</a>.</p>
<p>This detection coincides with the update of my IDE from VS 2015 to VS 2017 and the usage of the new compiler. It seems the new compiler generated the signature of a Trojan for Kaspersky. SoundSwitch have two important parts, the first one is the AudioEndPoint library that I created in C++ to use the WinAPI with on top a wrapper CLR to interface with C#. The second part is SoundSwitch itself which is the interface and the configuration tool in C# for the library.</p>
<p>SoundSwitch has two important parts, the first one is the AudioEndPoint library that I created in C++ to use the WinAPI with on top a wrapper CLR to interface with C#.</p>
<p>The second part is SoundSwitch itself which is the interface and the configuration tool in C# for the library.</p>
<p>I&#8217;m guessing the C++ lib triggered the false positive.</p>
<h1>How to report false positive</h1>
<p>Kaspersky provides an Online antivirus to check for files, the problems with it, is the lack of feedback when reporting a false positive: <a href="https://virusdesk.kaspersky.com/">https://virusdesk.kaspersky.com/</a></p>
<p>You get an automated email telling you they&#8217;ll look into it. But after multiple days, I never received any other email. This is the opposite of my experience with Symantec where a couple of hours after the report of false positive, I had a human asking for more details and information about my report. The issue then got resolved rapidly.</p>
<h2>The better way</h2>
<p>In the end, I decided to create an account on the Kaspersky portal to report my false positive: <a href="https://my.kaspersky.com/en">https://my.kaspersky.com/en</a></p>
<p>There I was able to submit my false positive, get a direct answer from the support and a confirmation that the false positive was confirmed and their database will be updated in the following days.</p>
<p>Two days later, Kaspersky stopped telling its user that SoundSwitch is a trojan.</p>
<h1>For the future</h1>
<p>From now on, I&#8217;ll delay the release of SoundSwitch, I&#8217;ll use <a href="https://www.virustotal.com">Virus Total</a> to check for any possible false positive and then when clean, I&#8217;ll release the program.</p>

Leave a Reply Cancel reply