search

microsoft / php-sdk-binary-tools

Tool kit for building PHP under Windows
BSD 2-Clause "Simplified" License
271 stars 78 forks source link

Heur.AdvML.B in task.exe? #20

Closed OdnaropX closed 7 years ago

OdnaropX commented 7 years ago

Hello.

After git clone my antivirus (Symantec Endpoint Protection) is reporting task.exe as being a heuristic virus (Heur.AdvML.B) on Windows 10.

After using the binary tools, the antivirus also removed some .dll from a php extension I was recompiling (.dll previous compiled for php 7.1 and now trying to compile for 7.2 with new toolkit). I not sure why Symantec now think my extension .dll is also a virus (it removed permanently without recover option, so I couldn't check the .dll's content to compare with a previous SHA512 I made of the file).

So I think that a should inform about this problem with task.exe. Hope is only me that are having this problem and not that task.exe in repository is contaminated.

weltling commented 7 years ago

Thanks for filing the report. The source code of task.exe is contained in doc/task.c, the releases are always tagged from the main repo. The task.exe itself seems to be unchanged for quite long. AFAIR, it was also compiled without the telemetry. Here's also what virustotal.com tells

https://www.virustotal.com/#/url/d1e62d8fb03ea232a1a9ea296d63770e1a479256a456758687ab89c66c0e9052/detection

After all, it looks like a false positive. There was some precedents before, also with the official release zipballs, too. Several times it seemed, that antiviruses took binaries with telemetry as something harmful. The latest versions of Visual Studio don't enable telemetry by default. Please be sure the latest signature databases and antivirus versions are used. Also, usually antivirus manufacturers have feedback forms, so please use it to report a false positive. Regarding your own extension - you can also send it to the antivirus manufacturer.

Thanks!