archimatetool / archi

Archi: ArchiMate Modelling Tool
https://www.archimatetool.com
MIT License
914 stars 267 forks source link

.lock - ransomware (false-positive)? #1016

Closed N3wScr1pt closed 5 months ago

N3wScr1pt commented 5 months ago

Hello,

We recently had a request to have your software utilized for XML modeling with Abacus, however, as part of our analysis and scanning process a file was flagged as ransomware. (see attached)

We contacted support via the Contact's page on your website and they replied stating that it was a false-positive and that the file was of "zero-byte / zero length". Nonetheless we have refrained from using this software until we can receive a solid confirmation that the scan was in fact a false-positive.

We used the x64 install with SHA-1 > bb71df085ef3522bc379529a785a69064b9f7b27 Archi-Win64-Setup-5.2.0.exe.

We like to gain confidence in utilizing this software and would like for the scan conducted by Cuckoo to result with no ransomware flag. Might there anything that can be done to reassure no such ransomware exists in your software?

V/R - Alex

faslsePos_ransomware_detected

Phillipus commented 5 months ago

As I said, that file is a zero length byte that is part of the installation of the underlying Eclipse framework. It's a lock file. It's empty, it does nothing. It's not even used.

I suggest you contact Cuckoo.

N3wScr1pt commented 5 months ago

Appreciate the reply and clarification.

On Jan 18, 2024, at 1:39 AM, Phil Beauvoir @.***> wrote:



As I said, that file is a zero length byte that is part of the installation of the underlying Eclipse framework. It's a lock file. It's empty, it does nothing. It's not even used.

I suggest you contact Cuckoo.

— Reply to this email directly, view it on GitHubhttps://github.com/archimatetool/archi/issues/1016#issuecomment-1898124196, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AU6B535YTCRQQVVU4Z66F5LYPDUTPAVCNFSM6AAAAABB743BE6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQOJYGEZDIMJZGY. You are receiving this because you authored the thread.Message ID: @.***>