search

qarmin / czkawka

Multi functional app to find duplicates, empty folders, similar images etc.
Other
19.81k stars 647 forks source link

Windows 11 say 8.0.0 GUI is virus #1367

Open item4 opened 3 days ago

item4 commented 3 days ago

Bug Description

Windows Defender block download/execute 8.0.0 GUI

Steps to reproduce:

Download v8.0.0 GUI in Windows 11

Debug log ``` webfile: C:\Users\Item4\Downloads\windows_czkawka_gui_46.zip|https://objects.githubusercontent.com/github-production-release-asset-2e65be/292065578/b98e5126-701d-4f9e-b656-3345a4a592cf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241011%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241011T075345Z&X-Amz-Expires=300&X-Amz-Signature=2b16cbf4b1fa3b8afb7af8ccfa9515bbda986f9d54224af48a2ca2de63b13c93&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dwindows_czkawka_gui_46.zip&response-content-type=application%2Foctet-stream|pid:14896,ProcessStart:133731068311798261 ```

System

item4 commented 3 days ago

when I click detail info button, windows show this page: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Program%3AWin32%2FWacapew.C!ml&threatid=265744

qarmin commented 3 days ago

Zip version contains precompiled version of gtk libraries by others

I checked this zip before via Virustotal and all antiviruses except one shows that there is no virus inside - https://www.virustotal.com/gui/file/7383855bbab3119274b6ed57fd468a4f48c4e221646a61f816aa5a562223b7b0?nocache=1 and one which found something do not like zlib1.dll file

image

This files are taken from this CI - https://github.com/qarmin/czkawka/actions/runs/11287366762 - you can manually verify hashes

You can also compile app yourself to check if defender still report problem

item4 commented 2 days ago

Today, MS released MS Defender 1.419.461.0 (KB2267602) and no more virus alert. I guess it was misdetection by MS