AsmSpy icon indicating copy to clipboard operation
AsmSpy copied to clipboard

Virus detected in binary download from appveyor

Open gingters opened this issue 4 years ago • 4 comments

As of today, Windows Defender detects Trojan:Win32/Spursint.F!cl in the .zip, and prevents unpacking the zip file. I downloaded asmpsy.1.3.131.zip from the page linked in the readme.

gingters avatar Nov 27 '20 10:11 gingters

Thanks for supporting this Sebastian. @rahulpnath or @michaelthyregod could this be something that's been introduced by the appveyor build?

mikehadlow avatar Dec 03 '20 09:12 mikehadlow

@mikehadlow Are we running into this issue mentioned here

On a side note, I tried downloading the zip and unpacking and surprisingly didn't throw any error. Also nothing when I explicitly scan the file. Below is my windows defender version/details image Does this match with what you have @gingters?

Also tried using VirusTotal to scan the zip and actual executable. The executable does show a warning since it is not signed.

rahulpnath avatar Dec 03 '20 19:12 rahulpnath

Thanks @rahulpnath. I think it's highly likely that we're running into something like the issue you linked. I think there's not much we can do other than depreciate the zip file download, or add a warning to the readme?

It might also be worth looking at distributing AsmSpy as a dotnet tool

mikehadlow avatar Dec 04 '20 09:12 mikehadlow

I noticed that there's only a nuget package on appVeyor, I bet it is due to this issue. However the readme file still says a zip file can be downloaded there. Maybe the readme should be updated if there's no plan to bring back the zip file on appVeyor. I'm not sure what the installation instructions should be.

malopgrics avatar Mar 10 '23 15:03 malopgrics