This question already has an answer here:
- AV detection of signed malware 2 answers
I have developed an IRP hooking based driver for one of my clients. Avast oes not complain about it but his AV suite reports it as malware. The lient will eventually sign this driver, but will it still be reported as malware by a handful (or more) AV suites or will it get green light everywhere ? I guess writing a filter river for the same purpose would not pose this problem, or ?