search

microsoft / etl2pcapng

Utility that converts an .etl file containing a Windows network packet capture into .pcapng format.
MIT License
652 stars 114 forks source link

Malware warnings #39

Closed eidze1 closed 3 years ago

eidze1 commented 3 years ago

Several browsers block the newest zip and detect it as being malware. The x86 binary is detected by 21 AV engines (virustotal.com) and x64 version by one. Not cool.

Blcktape commented 3 years ago

Version 1.5.0 is being marked as Malware. https://www.virustotal.com/gui/file/e2ee70f75cbd922823f1d9bc390e7ad7f49fed4d7b450831bc6bef8e2cb26a07/detection

z0th commented 3 years ago

Second this. Our local A/V is actively flagging the file hashes as well.

dzampino commented 3 years ago

I built this from source which also generated malware warnings in VirusTotal for both the x86 and x64 binaries, so I feel confident this is a false positive. My stab at a guess is that the change to statically link the C runtime is causing this to be flagged.

Links to my two VirusTotal scans: x86: https://www.virustotal.com/gui/file/85595af361227e1901fa18bb5f4c42dc5a0c114cb5ca67bac44f999c85cea2a9/detection x64: https://www.virustotal.com/gui/file/3e50a7e9b525884e73f463e1a6b5fcfc37bb0a8da1096642395aa297310f077c/detection

maolson-msft commented 3 years ago

Release v1.7.0 has signed binaries, which I'm hoping will prevent these AV warnings. Anyone still affected, please try it out and report back.

maolson-msft commented 3 years ago

Virustotal is green for the 1.7.0 release, so I'm resolving this. Please file a new issue if any new malware warnings crop up.