False positives in virus scans on release binary (v0.12.01+)

pagewin commented 5 years ago

Could be a few things, after some brief reading...

v0.12.01 added save backups. This reads and writes to the appdata directory, which might be triggering some scanners.
AssemblyInfo.cs GUID or something
Is this v0.12.01 only, or all of my releases? If it's all of them, different compiler might be doing stuff differently based on some settings or whatever.
Unsigned EXE... but the original probably never had them signed, either.

It's probably the writing to appdata part or something else introduced in that version. virustotal for v0.11.02 doesn't indicate anything other than some no-name scanner calling it "suspicious."

pagewin commented 5 years ago

Look at using IsolatedStorage if writing to appdata is the problem.

pagewin commented 5 years ago

Some heuristics still report a trojan without the backup functionality. virustotal for 0.12.01 without backup

Heuristics aren't perfect, but maybe this is a sign to drop C# development of this and rewrite it in something less of a pain to deal with outside of Windows (ha)

pagewin / MHXXSaveEditor

False positives in virus scans on release binary (v0.12.01+) #24