v1.32.2 - win archive is infected with trojan - Win32/Yomal!rfn

[Lexxxco]

Trojan: Win32/Yomal!rfn

container file: taggui-v1.32.2-windows.7z->taggui-v1.32.2-windows/taggui.exe

All previous versions were clean. Checked on several machines.

[jhc13]

It is a false positive. See #19, #110, #189, #269. You can run from source if you are concerned.

[miasik]

https://www.virustotal.com/gui/file/93866dc58a236c12758832e51b1119ef25e2ed1fe83bfe29847c8b255ebb564d

[maxgreco]

Lotto 1 - 3W -> 38 punti su 55 Lotto 2 - Lawing -> 50 punti su 55

Ok?

On Fri, Feb 28, 2025 at 9:42 AM miasik @.***> wrote:

https://www.virustotal.com/gui/file/93866dc58a236c12758832e51b1119ef25e2ed1fe83bfe29847c8b255ebb564d

— Reply to this email directly, view it on GitHub https://github.com/jhc13/taggui/issues/343#issuecomment-2690056590, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABXEI7NCGXDJ7L5G3G6XY2D2SAOOBAVCNFSM6AAAAABX7NYBBCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMOJQGA2TMNJZGA . You are receiving this because you are subscribed to this thread.Message ID: @.***> [image: miasik]miasik left a comment (jhc13/taggui#343) https://github.com/jhc13/taggui/issues/343#issuecomment-2690056590

https://www.virustotal.com/gui/file/93866dc58a236c12758832e51b1119ef25e2ed1fe83bfe29847c8b255ebb564d

— Reply to this email directly, view it on GitHub https://github.com/jhc13/taggui/issues/343#issuecomment-2690056590, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABXEI7NCGXDJ7L5G3G6XY2D2SAOOBAVCNFSM6AAAAABX7NYBBCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMOJQGA2TMNJZGA . You are receiving this because you are subscribed to this thread.Message ID: @.***>

--

Massimiliano Greco Sistema Informativo Arpa Piemonte (dip. di Biella) 015-8554227

about me: http://about.me/maxgreco

NOTICE Thank you for noticing this new notice Your noticing it has been noted And will be reported to the authorities

[studiomav]

It may be a false positive but it's so annoying that windows defender keeps quarantining this even though I choose to allow.

[nharvey-cs]

Code signing is one thing, being detected as a trojan is another. This should be addressed.

[jhc13]

Code signing is one thing, being detected as a trojan is another. This should be addressed.

What solution do you propose?

[nharvey-cs]

Code signing is one thing, being detected as a trojan is another. This should be addressed.

What solution do you propose?

I appreciate the quick reply. I can see there's a Virus Total report on this separate issue: https://github.com/jhc13/taggui/issues/359 18/69 detections is bad. I think the installer should be removed, and just clear build steps should be given instead. Something's bundled that's raising a lot of red flags and should be sniffed out. Just my opinion though, this is my GUI of choice and it's great work but trojan warnings perk my ears.

[jhc13]

I think the installer should be removed, and just clear build steps should be given instead.

The bundled version is just a potentially simpler install option for users who prefer it. The various dependencies often cause all sorts of errors during installation (see #346 for an example) and it's difficult to define steps that work for everyone.

Something's bundled that's raising a lot of red flags and should be sniffed out.

It's not that something problematic is bundled; it's a common issue with PyInstaller.

[jhc13]

I released a new version. Hopefully it does not trigger the false positive.

[miasik]

https://www.virustotal.com/gui/file/9fda8e612b7bea7a03c0dde52346956ac185f3fc788ce8e91db6aabfbee7d359/detection 4/17 for now