search

runt1me / stormcloud

Windows backup software from Dark Age Technology Group
2 stars 0 forks source link

Avast Quarantine Issue #49

Closed EccentricKnight closed 1 year ago

EccentricKnight commented 1 year ago

image

runt1me commented 1 year ago

Virus Total Analysis of stormcloud client EXE (8 of 71 products flagged): https://www.virustotal.com/gui/file/e14fb6ca2e525c7dc49e95f7aa11292c639d8e2df5e638bf9742378efc10e1fa?nocache=1

image

runt1me commented 1 year ago

I've managed to recompile pyinstaller from source and it beats the Avast signature. Link for new analysis: https://www.virustotal.com/gui/file/09468ae24e8380ab044df7a698f11be3c2e364e01bea85b95789a1f02580cb05?nocache=1

We are still popping on 4 AVs that VirusTotal scans with (Cynet, McAfee-GW-Edition, DeepInstinct, and SecureAge). These are all pretty fringe/sucky AVs so we might just be able to ignore these unless we find a customer who is actually using one of them.

Here's what I managed to do on my system to get it to work:

  1. Nuke all Visual Studio related stuff (run visual studio installer, go to more -> uninstall, and remove everything)
  2. Re-download only the 2022 Visual Studio Build Tools (https://visualstudio.microsoft.com/downloads/ -> go to "Tools for Visual Studio" section -> "Build Tools for Visual Studio 2022"
  3. git clone the pyinstaller source to C:\PyInstaller
  4. cd C:\Pyinstaller\pyinstaller\bootloader
  5. python.exe ./waf distclean all
  6. I have no idea why, but running with distclean appears to find the cl.exe file associated with MSVC, if you run it without distclean, it will not find it.
  7. cd C:\Pyinstaller\pyinstaller
  8. pip install .
  9. If that works, it should add the pyinstaller EXE to your path
  10. Rebuilt stormcloud with this pyinstaller and uploaded to VT
EccentricKnight commented 1 year ago

Updated mvp_installer.py on branch: "updated_installer" and commit: "We freaking did it" resolves this issue.