search

keybase / client

Keybase Go Library, Client, Service, OS X, iOS, Android, Electron
BSD 3-Clause "New" or "Revised" License
8.91k stars 1.23k forks source link

F-Secure PSB Workstation reports `...\AppData\Local\Keybase\runquiet.exe` as Virus #6688

Open soderluk opened 7 years ago

soderluk commented 7 years ago

Windows 10 Keybase GUI Version: 1.0.21-20170413113755+766e240

My F-Secure AV has now twice reported runquiet.exe as a virus: Gen:Variant.Symmi.73621 (virus). First time it quarantined it, the second time automatically deleted it. Is there something to do, other than mark the file as false positive? What does the executable actually do? Updates the GUI in the background? Just wanted to let you know.

maxtaco commented 7 years ago

Cc: @zanderz

aredington commented 7 years ago

I've seen a similar issue with BitDefender, the same file was identified as Gen:Trojan.Heur.JP.WX2@aWdsoIni

zanderz commented 7 years ago

runquiet simply launches a console application invisibly, so you don't see ugly flashing black cmd windows. Its source code is here.. Our executables are all signed with an EV cert from a Microsoft approved vendor, and there is little we can do about 3rd party AV vendors blocking them except to report false positives. We've done so several times but there are so many vendors, and we update regularly.