Why does Avira consider "CoCreateInstance()" function as a malware? - c++

Question

I have created c++ console application using visual studio 2017 which is extract .zip file. But, when I run application.exe file, Avira antivirus detects my exe as a malware.
I found CoCreateInstance(CLSID_Shell, NULL, CLSCTX_INPROC_SERVER, IID_IShellDispatch, (void **)&pISD) function where actual Avira create problem.
Why does Avira consider CoCreateInstance(CLSID_Shell, NULL, CLSCTX_INPROC_SERVER, IID_IShellDispatch, (void **)&pISD) function as a malware?
My Function:
bool Utils::Unzip2Folder(BSTR lpZipFile, BSTR lpFolder)
{
IShellDispatch *pISD;
Folder *pZippedFile = 0L;
Folder *pDestination = 0L;
long FilesCount = 0;
IDispatch* pItem = 0L;
FolderItems *pFilesInside = 0L;
VARIANT Options, OutFolder, InZipFile, Item;
CoInitialize(NULL);
__try {
if (CoCreateInstance(CLSID_Shell, NULL, CLSCTX_INPROC_SERVER, IID_IShellDispatch, (void **)&pISD) != S_OK)
return 1;
InZipFile.vt = VT_BSTR;
InZipFile.bstrVal = lpZipFile;
pISD->NameSpace(InZipFile, &pZippedFile);
if (!pZippedFile)
{
pISD->Release();
return 1;
}
OutFolder.vt = VT_BSTR;
OutFolder.bstrVal = lpFolder;
pISD->NameSpace(OutFolder, &pDestination);
if (!pDestination)
{
pZippedFile->Release();
pISD->Release();
return 1;
}
pZippedFile->Items(&pFilesInside);
if (!pFilesInside)
{
pDestination->Release();
pZippedFile->Release();
pISD->Release();
return 1;
}
pFilesInside->get_Count(&FilesCount);
if (FilesCount < 1)
{
pFilesInside->Release();
pDestination->Release();
pZippedFile->Release();
pISD->Release();
return 0;
}
pFilesInside->QueryInterface(IID_IDispatch, (void**)&pItem);
Item.vt = VT_DISPATCH;
Item.pdispVal = pItem;
Options.vt = VT_I4;
Options.lVal = 1024 | 512 | 16 | 4;//http://msdn.microsoft.com/en-us/library/bb787866(VS.85).aspx
bool retval = pDestination->CopyHere(Item, Options) == S_OK;
pItem->Release(); pItem = 0L;
pFilesInside->Release(); pFilesInside = 0L;
pDestination->Release(); pDestination = 0L;
pZippedFile->Release(); pZippedFile = 0L;
pISD->Release(); pISD = 0L;
return retval;
}
__finally
{
CoUninitialize();
}
}

Answer 1

There is no real good answer. Why AV systems detect some files as false positives.
Most of this false positives are based on some heuristic.
Small programs seam to be more problematic than larger ones.
Programs with less dependencies to other DLLs seams to be more problematic than complex EXE with dependencies.
Some mixes of API functions seem to be more problematic tahn other. Usage of more complex API functions and UI seem to be less problematic.
Signed executable are less risky for such heuristic traos in AV systems.
A lot of programs (and signatures of companies) are internally white listed. Your program is unknown.
This function is surely not the only API function you use. Check Depends and you find more!
Just add your exe path to the exclusion list of Avira... in the development phase of small tools I had to do this more than once.
Final tipp: Ask Avira and send them you file. They may change there heuristic pattern match so this is no longer a false positive.
I had this effects with Avira serval times.