Windows Release Binary: Trojan Detected

[oportocinco]

Link to GitHub Repo: https://github.com/FedoraQt/MediaWriter/releases/tag/5.2.0

Redirects to: https://github.com/FedoraQt/MediaWriter/releases/tag/5.2.0

Downloaded and installed the following file: https://github.com/FedoraQt/MediaWriter/releases/download/5.2.0/FedoraMediaWriter-win64-5.2.0.exe

md5sum: eb92d935ec723c2eb2fce2a411d6a436 FedoraMediaWriter-win64-5.2.0.exe sha256sum: fe7564f96e98c2a7320be9cf2433bbbaa9a3c0850cd5cf8e66556d310e347ad3 FedoraMediaWriter-win64-5.2.0.exe

Trojan:Win32/Bearfoos.A!ml

Alert level: Severe Status: Quarantined Date: 23/11/2024

Recommended action: Remove threat now. Category: Trojan Details: This program is dangerous and executes commands from an attacker.

Affected items: file: C:\Program Files (x86)\Fedora Media Writer\helper.exe

process: pid:8324,ProcessStart:133768220989190802

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3aWin32%2fBearfoos.A!ml&threatid=2147731250

[Belabacsi]

Same for me, I can confirm. After Windows 10 moved the helper.exe file to quarantine, it seems the Fedora Media Writer application still works, but it is complaining about that, "Help file is missing, check local installation."

[grulja]

I think this might be a false positive warning, from what I found on Google it's being reported for other applications as well. I will look whether there is something we can do about it.

Same for me, I can confirm. After Windows 10 moved the helper.exe file to quarantine, it seems the Fedora Media Writer application still works, but it is complaining about that, "Help file is missing, check local installation."

The application will start without the helper, but you will not be able to write images to your USB drive or restore your USB drive.

[enesf]

On my system Windows Defender detected it as "Behavior:Win32/Persistence.A!ml".

[grulja]

Hi, can you test whether #771 fixes it? There are Windows installers available for download in the CI run here: https://github.com/FedoraQt/MediaWriter/actions/runs/12007226983.

[enesf]

Hi, can you test whether #771 fixes it? There are Windows installers available for download in the CI run here: https://github.com/FedoraQt/MediaWriter/actions/runs/12007226983.

771 fixed it on my system.

[grulja]

Hi, can you test whether #771 fixes it? There are Windows installers available for download in the CI run here: https://github.com/FedoraQt/MediaWriter/actions/runs/12007226983.

771 fixed it on my system.

Great!! Thank you. I will merge it and make a new release.