search

Q726kbXuN / nytxw_puz

Turn NY Times crosswords into Across Lite files
The Unlicense
41 stars 10 forks source link

Windows Defender Virus Threat #8

Closed hankscorpio83 closed 2 years ago

hankscorpio83 commented 2 years ago

I assume it's a false positive, but just a heads up that the default Windows Defender settings detect a virus and deletes the .exe:

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3aScript%2fWacatac.B!ml&threatid=2147735503

However, VirusTotal shows only 3 vendors flagging it.

Probably not a lot you can do about it (I'm guessing it doesn't like scraping browser cookies?), but maybe add a note on the Readme so people aren't caught off guard?

Q726kbXuN commented 2 years ago

In as much as I can, I've verified that my build machine isn't the issue. I used a non-windows machine to spin up an Windows cloud instance, and only installed the tools necessary, Python and Git both from trusted sources and vetting the downloads, after letting Windows install all updates it found to build the distribution. The resulting package hit the same alerts on VirusTotal as the one I previously built that you downloaded.

Of course, anyone reading this: Don't take my word for it, please feel free to recreate these steps or build on your machine to verify this.

That said, the standard response to these sort of false positives in Python packages, notably in PyInstaller, is to bring the latest version of packages and build the bootloader manually. I've done both in the 0.72 pre-release

@hankscorpio83 Would you mind grabbing this version and see if it still triggers Windows Defender for you? If this fixes it, I'll figure out how I want to check in my changes. Otherwise, I'll probably just add a warning to the README as you suggest and move on.

hankscorpio83 commented 2 years ago

Thanks for the quick response. Your tool got mentioned on hackaday.com, so I figured it'd be worth discussing.

The updated release triggers a different "virus" threat in Windows Defender and two vendors flag it in VirusTotal.

Q726kbXuN commented 2 years ago

Thanks, I'll keep digging, but I've run out of time today. I've added a note to the README.

For anyone else seeing this, I'd welcome any insights into which package or tool is triggering these so it can be removed.

Q726kbXuN commented 2 years ago

I've moved to py2exe to build the executable, and Virus Total seems happier, though still not perfectly happy.

I'm closing this for now, since Windows Defender should no longer trigger. If it does for any reason, feel free to reopen this.