Current virus scanners look for behavioral patterns and anomalies of applications. This is usually done with a scoring system. How pattern details are collected and weighted, and at which threshold a virus alert is reported are the trade secrets of anti-virus vendors. We assume that the application receives additional points in the scoring system due to the protection added to it, which has been confirmed by several anti-virus vendors. The reason is that viruses use exactly these mechanisms to hide themselves. It takes therefore fewer matching patterns to reach the threshold. This explains why most false positives are protected applications.

However, you can increase your score in the virus scanner scoring systems by using Microsoft’s technology Authenticode to sign your application code with digital certificates. Considering the mechanisms of virus scanners, this provides no ultimate guarantee, but the risk of your application being detected as a virus is significantly minimized.