openvr_fsr_app icon indicating copy to clipboard operation
openvr_fsr_app copied to clipboard

App/Portable is being detected as a virus

Open MrDecepticon opened this issue 3 years ago • 12 comments

Went to install version 0.3.0 and Windows Defender immediately removed it due to it being detected as a virus. trojan

MrDecepticon avatar Aug 12 '21 15:08 MrDecepticon

Sorry, didn't realize I could edit the title. Reason for closing initially.

MrDecepticon avatar Aug 12 '21 15:08 MrDecepticon

There is nothing I can do about that. You guys could buy me an EV code signature for $699/year but I guess that is a bit much for such a small poece of software :/

tappi287 avatar Aug 12 '21 15:08 tappi287

Is... there any way to get this to even run at all now? I can't even override it, it just deletes the exe file.

shebang79 avatar Aug 16 '21 17:08 shebang79

https://www.virustotal.com/gui/file/ade5fe4b0a3e0d8d77f91090b378aa6be48bc6da71d5ca4d3eacdae1497c69bc/detection

Other Scanners also detect the app/zip as virus

TheWolfaw avatar Aug 16 '21 20:08 TheWolfaw

Question is, "Does it contain a virus?" I know the older version works great

mrcottonmouth avatar Aug 16 '21 20:08 mrcottonmouth

Just a little explanation to this: there is no way for you, for me or for any so called (Anti) Virus software to detect if a piece of software is a "virus". There is only software. If the software acts in malicious ways, it is of course unwanted software. But there is no way to detect this just by looking at the files.

For detection they do plain, dumb pattern matching or even machine learning which is just another way to put a database together automatically and call it "artificial intelligence". A certain arrangement of files or a certain file hash within an arrangment of files triggers the alert based on similar patterns that have been identified as unwanted software in the past.

One way around this is to sign the final build arrangment with a signature. That would at least tell you and your OS that this piece of files was created by someone with a verified identity(and just that!). But as mentioned earlier I have no spare 700$/per year to buy a signature.

You can be assured that I will not upload any unwanted software to any of my repositories. I am the only one having access to publish files on this repository so if you look thru my profile, my interaction with other user, you may decide to trust or not trust me. If you decide to trust me, you can tell your (Anti) Virus-Software to do so aswell for files that you have downloaded from https://github.com/tappi287/openvr_fsr_app/

tappi287 avatar Aug 17 '21 01:08 tappi287

Well, I found out how to work around the problem. If I downloaded the portable version, put it somewhere, then followed this guide https://support.microsoft.com/en-us/windows/add-an-exclusion-to-windows-security-811816c0-4dfd-af4a-47e4-c301afe13b26 that allowed me to run the program normally.

Which the moment I did, reported that there was a new version that doesn't require this haha

Hey so its all good then lol

shebang79 avatar Aug 17 '21 01:08 shebang79

Hello! Thanks for the latest update.

Sadly, it is still showing a false-positive virus: https://www.virustotal.com/gui/file/fa83bcf8faa88bc170cf6fa376ab4589c3157004fde3d4d84807ba6c3384efcf/detection

I bet there are many people not using this great tool because of that...

Thanks!

ASchneiderBR avatar Sep 02 '21 18:09 ASchneiderBR

Hey, thanks for the hint but again, there is nothing I can do about that. I've explained the reasons above. It's like saying anyone with license plate ABC-123(File hash) is a terrorist. Btw, this is open source. If you have the financial resources: take the code, build it with a code signature(available from 700$/year) and sell the software on some marketplace.

tappi287 avatar Sep 02 '21 18:09 tappi287

got this for the first time with the latest version

azumukupoe avatar Feb 01 '22 17:02 azumukupoe

got this for the first time with the latest version

Do you have a file hash that is triggering this? I'm tempted to play the lottery with an integer version of that hash =}

tappi287 avatar Feb 01 '22 18:02 tappi287

It might be worth looking into https://www.sigstore.dev/

ButterscotchV avatar Apr 06 '22 04:04 ButterscotchV