search

GuillaumeGomez / sysinfo

Cross-platform library to fetch system information
MIT License
2.02k stars 301 forks source link

Windows Defender Detects Windows Executable Using this Crate as Trojan #1335

Closed aza547 closed 1 month ago

aza547 commented 1 month ago

Realise this is a pretty vague report, and it is possible it's caused by something in rust rather by something in the crate. Any advice on how to resolve is welcome.

Describe the bug Rust Windows executable using sysinfo gets flagged as a trojan on Windows. I'm using a tiny rust executable as part of an application to monitor the state of some Windows processes (and to detect if they are up or down).

After submitting it for analysis here, I see the false positive below:

image Specifically it's upset about "Program:Win32/Wacapew.C!ml".

To Reproduce This repository reproduces the issue: https://github.com/aza547/rust-ps. I can reproduce it by building the executable there and scanning the file.

aza547 commented 1 month ago

I should say this happened on v0.30.12, I'm repeating now on the latest (https://github.com/aza547/rust-ps/commit/1a2336f92a9f69d070e972037d61fcf1ffcfdd7f), so maybe that resolves it.

aza547 commented 1 month ago

Looks like https://github.com/GuillaumeGomez/sysinfo/issues/991 :(

aza547 commented 1 month ago

It does seem to have passed the scans after updating to 0.31.2. Not sure if that's because something has genuinely changed or if the Windows defender scan is just a coin flip or not. I'll keep an eye on it.

GuillaumeGomez commented 1 month ago

Seems to be a duplicate indeed. Thanks for the information! Closing in favour of #991.