search

Dijji / XstReader

Xst Reader is an open source viewer for Microsoft Outlook’s .ost and .pst files, written entirely in C#. To download an executable of the current version, go to the releases tab.
Microsoft Public License
535 stars 79 forks source link

VirusTotal #43

Open Michal-Witwicki opened 3 years ago

Michal-Witwicki commented 3 years ago

Useful app, but I'm worried that one of your antivirus software reports it as malware https://www.virustotal.com/gui/file/df6de6df2ab6279b623b916e44dc242cad72b1730509a13dee04420bcff16b47/detection.

Dijji commented 3 years ago

Thanks for letting me know. I note that only one out of 70 antivirus engines reported that a virus had been found. And that one is Cynet, which, looking at their site claims to be a new AI- based approach capable of detecting zero day attacks. I have reported it as a false positive to them (Cynet support case 00626226).

I'm reassured by the 69 clean bills of health. I know I haven't put anything in there, but I can never rule out the possibility of something sneaky having got on my build machine. Do you get the same results if you build it yourself?

Michal-Witwicki commented 3 years ago

It's good that you reported, it's worth eliminating false positive. Unfortunately, I don't know because I don't know how to build software :).

Dijji commented 3 years ago

Here is the response from Cyren:

Your case 00626226 has been closed.

The submitted content is not detected by Cyren. If at any point the content was detected by Cyren, this appears to be already corrected in the latest definition files version.

Please make sure to update to the latest AV definition files version.

So I asked VirusTotal to rescan the file, but Cyren still reports positive. The only thing to do seems to be to wait for VirusTotal to get some updated definitions.

The rescan also returned a second positive, this time from MaxSecure, for Trojan.Malware.300983.susgen. And all this without changing the file at all! MaxSecure makes rather harder work of submitting a false positive, and I notice after a quick web search that I'm not the only piece of open source software to have this virus detected by MaxSecure, so I'm inclined to ignore this one for now as a blip from a relatively minor provider.