search

gbdev / rgbds

Rednex Game Boy Development System - An assembly toolchain for the Nintendo Game Boy and Game Boy Color
https://rgbds.gbdev.io
MIT License
1.35k stars 172 forks source link

rgbgfx.exe from rgbds-0.6.1-win64.zip is suspected trojan Artemis at virus total #1172

Closed z80-AF2882 closed 10 months ago

z80-AF2882 commented 1 year ago

Steps to reproduce:

  1. download archive from rgbds-0.6.1-win64.zip on some "safe machine" to rule out infection from PC... tried it on my iPhone and iPad :-)
  2. extract rgbgfx.exe
  3. go to virustotal.com
  4. upload exe file

Expected: green field Reality: several detections (Avast, McAffee, AVG)

Link to detection https://www.virustotal.com/gui/file/c7dcd478d3cb6f8cf90639d35fed6e8b84b60dea94c686c68ef8a218e39deb62

z80-AF2882 commented 1 year ago

Related to #1136

z80-AF2882 commented 1 year ago

Side note: there are no issues reported when built from sources in cygwin with libpng16 - not by my local AV nor by virustotal. Could there be really somthing wrong with released exe? Or just not makred false positive as my exe has different hash?

Rangi42 commented 10 months ago

This was definitely a false positive, and 0.6.1 is out of date now anyway.

aaaaaa123456789 commented 10 months ago

Side note: there are no issues reported when built from sources in cygwin with libpng16 - not by my local AV nor by virustotal. Could there be really somthing wrong with released exe? Or just not makred false positive as my exe has different hash?

What's wrong is that AVs are nowadays using machine learning to detect malware, and that's extremely prone to false positives. As you can see here.

As a general rule, if something only flags a couple of AVs, it's probably a false positive. Also, disregard every single result flagged as a machine learning result (e.g., a virus name ending in !ml in a few engines) — those are almost never actual viruses.

Rangi42 commented 10 months ago

The big names you noticed, Avast, AVG, and McAfee, no longer complain about rgbgfx 0.7.0. Only MaxSecure and SecureAge, and as ax6 said, a few random scanners giving false positives is to be expected. (Should have put "Removed virus" in the changelog. :P )

LIJI32 commented 10 months ago

Worth noting that SecureAge is a trashy piece of software that reported every single EXE file I tried as a malware, including binaries included with Windows itself. I mailed VT about it, saying that it's better removing it from the service, but it didn't help much.