Archisteamfarm: ASF 1.5 detected as trojan

[mahadi22]

today, ASF 1.5 detected as trojan by windows defender
screenshot
windows defender: http://mahadi.noip.me/ss/1456346634-m.png
virustotal: http://mahadi.noip.me/ss/1456346951-j.png

[JustArchi]

Doesn't make any sense to me considering that it doesn't detect up-to-date pre-release instead. I'm wondering which part was considered as false-positive.

I guess I'll just release V1.6 to workaround that issue. Still, doesn't make any sense to me.

[JustArchi]

Probably one of the methods used by ILRepack triggers that, as viruses tend to use repacking methods as well.

[JustArchi]

Leaving it open for eventual further analysis. If for some reason one of the parts of ASF is considered as false-positive, I should find out which one and check what is possible to do, because most likely V1.6 will be falsely flagged as well.

Code of ASF is open-source, so if somebody for any reason doesn't believe my statements he can analyze the code and compile himself, as stated in the wiki.

[JustArchi]

V1.6 seems to have similar issues - https://www.virustotal.com/file/3219c66e23f449943b26368412a07da4ee6a65a331618c5a798c0c72901c89d7/analysis/1456348367/

[JustArchi]

Non-repacked version has similar results - https://www.virustotal.com/file/3e5a19f1a5a67f9351c02024665fd2db0188f35dbf45f4766cab0ffe093c6460/analysis/1456348526/

(No reason to avoid ILRepack then)

[JustArchi]

http://stackoverflow.com/questions/33998715/visual-studio-2015-community-trojan-heur-qvm03-0-malware-gen

[Pandiora]

Just zip the zip and then zip it.

[JustArchi]

I released 1.6.1, but I doubt that signing app will help in any case. Let me know if up-to-date windows (defender) detects 1.6.1 as a virus as well.

Edit: Apparently signing in fact helps.

[Ryzhehvost]

Just another false positive. ASF 1.5 Already shows as clean on virustotal, and 1.6 has one false positive yet (but not Microsoft). Blame crappy antiviruses for this.

[JustArchi]

Hm 1.6.1 looks good then? No new reports? No weird windows defender false positives?

[Firestar98]

1.6.1 resolved the issue on my end. I have a new issue but that'll be a separate bug report, once I investigate it a bit more.

[JustArchi]

Feel free to post if similar thing happens then.

[mattnotmitt]

The zip for v2.1.2.5 is detected as malware on Windows 10 by Windows Defender. http://i.imgur.com/N2WebxF.png

[JustArchi]

Fixed.

[Flixbox]

I'm currently running V3.2.0.2 win-x64 and it's been detected as a Trojan.

[Zuelly]

I have had the same thing just before.

[DkXfS]

Yeah. I got the same message from Win Defender just now. I think we probably need to open a new issue, coz this one is marked as closed.