Release 0.8.2 being flagged as a trojan

ThibautSF / ParadoxosModManagerRework

Software to manage mods for recent Paradox games, work in progress, Java 11

MIT License

64 stars 7 forks source link

Release 0.8.2 being flagged as a trojan #28

Closed majones27 closed 4 years ago

majones27 commented 4 years ago

Good Afternoon! I am opening this issue to report that version 0.8.2 is being flagged by McAfee Internet Security as containing a trojan identified by it as genericRXDR-LM!A78E44C4F76C. Version 0.8.1 was not flagged as such by McAfee. I am hoping that is just my virus scanner being overly zealous.

ThibautSF commented 4 years ago

It should be a false positive.

But it's strange that you have it only in 0.8.2 and not 0.8.1 since the file which causes a problem is the .exe This executable is a wrapped .bat file which executes another bat file ("batception") and it's something antivirus doesn't like.

MixedMethods commented 4 years ago

Both are being flagged as trojans on malwarebytes

HaydenReeve commented 4 years ago

I am also being warned of the following on the ParadoxosModManager-win.zip for the 0.8.2 release.

A screencap can be found here.

ThibautSF commented 4 years ago

Still false positive (due to the presence of an unsigned exe file)

Distributed versions of PMM are built and packaged by GitHub Actions. None functions of PMM alter any system file or any other file/directories than :

the root directory of PMM
document directories of each Paradox Game supported: precisely, can write settings.txt/pdx_settings.txt/dlc_load.json and read .mod files in mod/ folder (can also create those files in case of a custom order for legacy version)

All the code is completely public and readable.

ghost commented 4 years ago

Virus Total is flagging the exe file on 32/71 engines, very odd.

ThibautSF commented 4 years ago

Redirected to #36