search

obsproject / obs-plugintemplate

GNU General Public License v2.0
307 stars 142 forks source link

Windows installer flagged by Windows Defender #108

Closed EZ64cool closed 11 months ago

EZ64cool commented 11 months ago

Operating System Info

Windows 10

Other OS

No response

OBS Studio Version

30.0.0

OBS Studio Version (Other)

No response

OBS Studio Log URL

NA

OBS Studio Crash Log URL

No response

Expected Behavior

The windows installer shouldn't be flagged as a trojan

Current Behavior

Windows Defender currently flags the "*-windows-x64-Installer.exe" as a Trojan:Win32/OffLoader!MTB and promptly deletes the file.

Steps to Reproduce

  1. Create a release using tags
  2. Download the created "*-windows-x64-Installer.exe"
  3. Scan with windows defender ...

Anything else we should know?

This wasn't happening before I merged with latest. https://github.com/EZ64cool/obs-hadowplay/issues/9

PatTheMav commented 11 months ago

Our working theory is that this is due to lots of malware using an almost-default InnoSetup configuration (much like we do for the plugin template) and as such generated installers run afoul of heuristics checks.

There is really not much we can do about that (except for developers to report false positives for their installers to Microsoft, though that's admittedly quite annoying).

If somebody wants to replace InnoSetup with NSIS (in the hopes that it generates less false positives) we'd probably be open to review/merge it.