VirusTotalUploader icon indicating copy to clipboard operation
VirusTotalUploader copied to clipboard

Virus Total flags your own program as malware

Open LinuxOnTheDesktop opened this issue 2 years ago • 8 comments

Please see here, which is the VirusTotal report for the zipped version of your program. Obviously, this is 'doubleplus not good'.

LinuxOnTheDesktop avatar Aug 25 '21 14:08 LinuxOnTheDesktop

The situation seems even worse (though VirusTotal appears unable to count . .) with the unzipped file.

LinuxOnTheDesktop avatar Aug 25 '21 14:08 LinuxOnTheDesktop

Unfortunately, as it has been discussed numerous times, without code signing certificate, anti-viruses tend to flag it as risk ware.

That's why the executables you see in release section are built on AppVeyor, directly from source code.

SamuelTulach avatar Aug 25 '21 18:08 SamuelTulach

Presumably you should put something to that effect in the README.

LinuxOnTheDesktop avatar Aug 25 '21 18:08 LinuxOnTheDesktop

After a quick check and chat with some people, it seems like the empty info in AssemblyInfo.cs was causing the detections. Also I will hopefully have a code signing certificate for the future.

SamuelTulach avatar Aug 25 '21 18:08 SamuelTulach

Unfortunately InnoSetup still seems to get flagged. I will probably try to move away from it, but that would need a custom installer since I am sure other generic install creators would be flagged.

SamuelTulach avatar Aug 25 '21 18:08 SamuelTulach

Right. In the meantime I do advise modifying the README. Thank you for your software.

LinuxOnTheDesktop avatar Aug 25 '21 19:08 LinuxOnTheDesktop

I've got code signing certificate now too. Unfortunately the InnoSetup installer is still (ironically) getting flagged by some AVs. I will probably end up writing a custom minimal installer myself.

SamuelTulach avatar Dec 31 '21 20:12 SamuelTulach

Considering they themselves mention and link to this software as a replacement for their own, discontinued, version, you'd think they would make the effort to make sure this didn't happen as well as ensure there is no malware in it. But I agree, if this is an issue, it's best to mention it in the readme and probably even on the releases page.

vertigo220 avatar Jan 12 '22 21:01 vertigo220