search

danpla / dpscreenocr

Program to recognize text on screen
https://danpla.github.io/dpscreenocr/
zlib License
241 stars 18 forks source link

Avast and AVG detect qwindowsvistastyle.dll and qwindows.dll as "Win32:MalOb-IJ [Cryp]" #20

Closed Theo1996 closed 2 years ago

Theo1996 commented 2 years ago

some of the dlls are detected by avg as heavily disguised malware

danpla commented 2 years ago

Yes, I'm aware of this: a person on Hacker News informed me of this two days ago.

Here is a Virus Total report: https://www.virustotal.com/gui/file/2adff5ef8aaf1c7674422cdd6ed35a9d218e5b1c354e5ddb8c73c55e5c2a69c5/relations

As you see, it's a false positive from AVG and Avast (I believe they are essentially the same program under the hood). The warnings are reported for qwindowsvistastyle.dll and qwindows.dll; I found that this happens for many other libraries built by MSYS2, but only after their debugging symbols are stripped via strip - either by an explicit invocation or as part of the build process.

So the best I can do here is to either include the debugging symbols in the mentioned DLLs (which will increase their size), or report the false-positive to Avast/AVG and hope that they will fix their heuristic.

Theo1996 commented 2 years ago

Ok thanks.

danpla commented 2 years ago

It looks like they fixed the false-positives. VirusTotal reports are now clean:

danpla commented 2 years ago

I'll close the issue since the problem seems to be gone.