search

ArtificialQualia / PyEveLiveDPS

PyEveLiveDPS (PELD) is a live DPS calculator and grapher for EVE Online
GNU General Public License v3.0
157 stars 27 forks source link

Virus warning #74

Closed wvdvegt closed 3 years ago

wvdvegt commented 3 years ago

FYI

Today PyEveLiveDPS gave me a threat warning from the Windows 10 Security scanner and was put into quarantine:

Trojan:Win32/Fuerboos.E!cl

This program is dangerous and executes commands from an attacker.
ArtificialQualia commented 3 years ago

Thanks for the heads up! This must have recently started happening as I haven't seen that in any of my releases before.

Can you tell me what version you downloaded that you got this threat warning on, and if it came from the installer or standalone download?

wvdvegt commented 3 years ago

Hi

The warning came this morning. I have removed the repo for now so I can't be 100% sure of the version (from a partial git repo the latest log message i see is a tag: v2.6.1, so probably a slightly older version by now).

The file triggering the warning was 'build\setup-for-installer\PELD.exe'

Note: the threat was 'determined' by AI.

ArtificialQualia commented 3 years ago

Oh, you were doing your own builds? Very nice!

I did some testing on my end too and at the very least I'm getting this on the PELD-standalone-v2.7.1.exe I've opened a ticket with Microsoft to remove this false positive, that may take some time though.

For now, it appears the PELD-installer-v2.7.1.exe (available here: https://github.com/ArtificialQualia/PyEveLiveDPS/releases/tag/v2.7.1) is not being flagged and should work for anyone who is experiencing this issue.

The .exe that got flagged for your local builds is a temporary artifact that gets used for InnoSetup to complete the process of creating the installer. I'll see if that false positive can get fixed as well. If not, I may need to revisit the build process.

I appreciate the information, and will keep this ticket open to track the progress of this issue.

ArtificialQualia commented 3 years ago

I've gotten a response from Microsoft. They have removed the false positive that PELD was causing.

If you update your virus definitions (anything >=1.333.1110.0 should work) in Windows Security PELD should no longer be considered a threat.

If you notice this or anything else in the future please let me know. Thanks again!