Got issues with your Clickteam Fusion 2.5 game or app and antivirus false positives? It’s been a problem almost since the birth of Multimedia Fusion 2 back in 2006! A number of threads are constantly appearing on the forums regarding this issue and it does seem to be quite annoying. We’ll cover the issue at hand in this post.
What is a false positive?
You have worked hard for months on a game and then boom, out of nowhere comes a random thread posted on Steam or your forum.
My antivirus has detected your game as a virus
How? You sit there scratching your head for hours. How could this be? You compiled your application on your development PC which is clean, you put together the packaged installer on your development PC too. So how could this have suddenly caused an issue?
Other Runtime users. That is the issue.
A false positive means your game/app (executable) has been flagged on the antiviral databases as containing code that resembles what has either been flagged previously or recently. It doesn’t matter if your game is called myawesomegame.exe and the actual issue file from 2015 was called thishorribleapp.exe – they contain the same blocks of code, whether two different games or not.
The Clickteam Fusion 2.5 Runtime
The Clickteam Fusion 2.5 runtime is a very special set of instructions that allow your Fusion 2.5 games and apps to run. To describe this in the best possible form of an analogy is; your game is the shell of a car and the runtime is the engine.
All games and apps designed and developed with Clickteam Fusion 2.5 are all cars. Your new game is a new car. It is still the same ‘engine’ that is running the car and that’s the runtime. So the problem here is, when you compile your standalone application, you are shipping the engine with it. The same engine that 293,293,029 other Fusion 2.5 compiled apps have been developed with.
The engine contains blocks of ‘code’ that allow the Runtime to interpret your Fusion 2.5 events and run them accordingly.
If, someone develops a malicious app with Fusion 2.5 that causes a user to freak out (ie: you take over the mouse or it crashes the OS) then the user will more than likely ‘flag’ it with their currently installed antivirus. Now, the issue here is, it’s not your shell (game) that gets flagged, it’s the runtime and everyone else is using that same runtime, hence why this issue crops up so many times.
Ways to resolve the false positive
There are numerous ways to try and avoid a false positive getting flagged up for your game or application. However, unfortunately there is no absolute method of this. On the flipside, it doesn’t happen to every developer. But in the bad luck running you do get sideswiped by a false positive, there are a few tips I can give you right now in ensuring that your game or app developed with Fusion 2.5 can try and avoid this unavoidable pitfall.
Don’t compress the runtime
The first thing to do is always ensure you ‘UNCHECK’ – Compress the Runtime in your application properties. Ensuring that the runtime is not compressed, it means your ‘shell’ of an executable becomes the runtime. If you compress the runtime, your app remains the ‘shell’ and the runtime is extracted to a temp directory. A surefire way of upsetting antivirus software. So always ensure you do not compress the runtime.
Sign your Fusion 2.5 apps
Sign your applications. If you are a serious developer who wants protection, it’s a very wise idea in this day and age to digitally sign your applications. You can sign both your executable file and the installer executable too. Code signing doesn’t come cheap however. It does come at a cost and I highly recommend Certs4Less but also search around. This is optional and not mandatory. It just depends how serious your are about protecting your project and reassuring your users.
Use a multi-online scanner then report
There is an abundance of free online scanners available that will scan your installer or executable for you. Some will even run your executable through all the top AV softwares and report which ones are flagging them. You can then use this list to report a false positive to each AV company.
If you need extra firepower, pop a notice on your website, forum or Facebook/Twitter page and ask all of your users to also report the false positive. This should help speed up the process.
Fusion Runtime Conclusion
Apart from those tips, there isn’t really much more I can improvise on. If you don’t think code signing is worth the money or the hassle, then just remember, that to upload apps to the Google Play Store or the iOS iTunes Store, your apps need to be digitally signed, so the same kind of attitude should be taken towards your games and apps too.
Clickteam cannot take responsibility for this, rest assured, if they could I would push but they can’t. This kind of third party behaviour is out of Clickteam’s hands and they shouldn’t be held responsible either. Clickteam develop a fantastic runtime that allows you to distribute your games and apps, so I advise if you are in the game/app development field on a serious development level, the above steps will prove paramount in your quest to ‘fill in’ the unavoidable pitfall when you do come across it.
Happy Developing!