win32ss / supermium

Chromium fork for Windows XP/2003 and up
https://win32subsystem.live/supermium/
BSD 3-Clause "New" or "Revised" License
1.83k stars 60 forks source link

Antiviruses Keep Flagging Supermium as malware. #315

Open ExiledCourtney94 opened 3 months ago

ExiledCourtney94 commented 3 months ago

Hello just figured I would let you know that anti viruses keep flagging supermium as malware.

Virus total https://www.reddit.com/r/windows7/comments/1b5ej7z/is_supermium_safe/

This person said comodo anti virus flaged supermium since it was making unusual IP address pings so no idea what was going on there. https://www.reddit.com/r/windows7/comments/1awpn0j/supremium_migration_from_brave_ff_pops_up_odd/

Than just recently I installed malwarebytes & malwarebytes is flagging supermium's firewall access as malware. I had to manually look in the registry to find out what malwarebytes was flagging.

Which was this Adware.Ghokswa.Generic, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{B3E6F332-3127-46DA-9F0A-AFCAA7DE2A51}

So I went to where malwarebytes said there was a virus. I opened up the registry than I saw this

c=Inbound rule for Chromium to allow mDNS traffic.|EmbedCtxt=Supermium|

so immediately knew it definitely wasn't malware:

So I told malwarebytes to ignore it but I am just wondering if there's anything you can do on your end? To get antiviruses to read or register supermium as safe?

Blaukovitch commented 3 months ago

So I told malwarebytes to ignore it but I am just wondering if there's anything you can do on your end? To get antiviruses to read or register supermium as safe?

For antivirus companies, this issue is solved by digital signatures (cert) for PE COFF files. Or the author should write to the antivirus companies themselves to include his software in a package of testing for false positives - such testing is always done when antivirus updates are released.

win32ss commented 3 months ago

Supermium 122 appears to be in a good state as no vendors appear to be tagging the 122 executables and binaries.

Marek33 commented 3 months ago

Supermium 122 appears to be in a good state as no vendors appear to be tagging the 122 executables and binaries.

I don't want to be the bearer of bad news, but the Norton Power Eraser says that multiple things are viruses. At least the Roguekiller, and Malwarebytes (the older version) do not report it.

Anton-V-K commented 2 weeks ago

Supermium 122 appears to be in a good state as no vendors appear to be tagging the 122 executables and binaries.

Well, Supermium 122.0.6261.152 (R6) is still flagged by some engines at VirusTotal: