Open chrolivier opened 4 years ago
Hi,
I would like to report the same issue. Our software is also build with cake and released with squirrel. As of today 11 September 2020 we start getting flagged with Trojan:Win32/Fuery.C!cl and Trojan:Win32/Wacatac.B!ml.
After investigation, the .exe files we build are clean. The .exe files created by squirrel are not.
Only Cylance seems to detect the nupkg itself
Some niche scanners flag setup.exe
At a guess, at some point some adware used Squirrel and instead of writing signatures for the adware, some companies wrote signatures for Squirrel.
Can anyone confirm that the flagging is still happening?
If it does, can you please add the VirusTotal links here?
We're running into this with 2.0.1 as well.
No choice but to revert. 1.9.1 still reports fine.
We've faced the same issue in our software https://www.virustotal.com/gui/file/2cb395d9d27bb48cee5381bea94b0467e48bd777d34635034c9d5c26e3109e49/detection Setup.exe is just renamed ThemeDesignerLauncher.exe
Would be nice if the maintainers could rebuild/repackage. Not sure if there is a way to keep this from happening altogether, maybe randomizing the layout of the generated binary.
Unfortunately we face the same issue, is there any workaround?
@JKronberger You can contact MS support to add your application to the white list (false positive). We've done it and the Defender doesn't trigger warn for our app.
@alexdi220 Thanks for the hint, we will try immediately.
We used "Submit a file for malware analysis" (https://www.microsoft.com/en-us/wdsi/filesubmission) and a few days later, our app seems to be on the whitelist. Hopefully it is not added to the blacklist again when we release a new version...?
If you are facing this for your application (i.e. not the template setup.exe
distributed with NuGet), here are a few important things to fix it as well as avoid SmartScreen:
Squirrel version(s) 2.0.0
Description The tools\Setup.exe file in the squirrel.windows.2.0.0.nupkg package triggers a malware warning from Windows Defender when it is extracted from the package. I first experienced this on 27 Aug 2020 when running a cake script to build a setup package.
Steps to recreate
Expected behavior No antivirus warnings should go off
Additional information I realize this is probably not an issue with Squirrel but actually a false positive from Windows Defender. You may just want to check and submit an issue with Microsoft.
Tested on: