Delphi Virus warning

[Bruce53 1]

Does anyone know how to deal with this problem.

I downloaded the Delphi 2010 ISO from Embarcadero.

Installed it on Windows 11.

Run and create new form application.

Windows immediately deletes the program1.exe with a virus warning.

I saw online that there is a fake Delphi virus but how do I confirm this and how do I get to write a Delphi 2010 program? 

 

 

[Bruce53 1]

Just an update.

I have found many comments about a false positive with Delphi.  So, the first (and easiest) step is to exclude the default projects folder from a virus check.

This works for both Delphi 2007 and 2010.  But, it would be impractical to add a folder exclusion for every program.

The next idea is to exclude the process bds.exe from virus warning.  This also works (for both 2007 and 2010 and all new Delphi projects).  But, I would very much like to hear comments about the safety of this action.

 

Next, I got a warning about "SetThreadContext failed" with Delphi 2007.  In 2023 Michael Charles Aubrey wrote about fixing this.

Just search this: Fixing the "SetThreadContext failed" Assertion Failure in Delphi 2007 on Modern Windows Machines, Including Windows 11

I downloaded the dll fix from Embarcadero and it's now working.

 

[Lajos Juhász 293]

First step is to exclude the folder for a project that antivirus program reports and upload the generated exe to VirusTotal. If it is a false positive the next step is to report it to your antivirus program as false positive.

 

Edit. So far, I have done this twice. Last time, a couple of years ago Microsoft Defender started to mark the Delphi executables as virus infected. After I filled the report, the issue was gone in 5-7 days. The other time when I did it was more than a decade ago.

 

Edited February 19 by Lajos Juhász

[Bruce53 1]

It all seems a bit tricky.  I generate a blank form Delphi app and 22/72 on VirusTotal identify the file as malicious.  Oddly enough, one of the ones in VirusTotal that clear it is Microsoft Defender.  But, on my laptop, it was Microsoft Defender that called virus.  All Delphi developers could face a similar problem.  I can't give a program to a customer and say it's just a false positive.  Especially if 22/72 other  virus checkers call it a virus.  In searching online. I'm surprised to not find Embarcadero all over this.

[Bruce53 1]

As another test, I created exactly the same blank form Delphi 2007 and 2010.

Delphi 2007 has 12/72 security vendors and no sandboxes flagged this file as malicious.

Both programs are identical blank forms.  The only thing I can say for sure it that I did not write a virus because there is no code from me.