Usdx: Current .exe detected as trojan

[MrMcX]

Actual behaviour

Windows detects the current .exe as a trojan(Trojan:Win32/Occamy.C and Trojan:Win32/Vagger!rfn)

Expected behaviour

File should not been detected as a trojan

Steps to reproduce

1a. Download file on Windows 10: https://github.com/UltraStar-Deluxe/USDX/releases/download/v2017.8.0/UltraStar.Deluxe_v2017.8.0.stable_installer.exe
2a. Wait for Windows Defender Report

or

1b. See Virustotal result: https://www.virustotal.com/de/file/2aaee687cc04043875e7cdc2620c07524e8f349ee7bd77960d02cd8e4f62d828/analysis/

Details

[basisbit]

Not a bug of UltraStar Deluxe. Suggestion: don't use snake oil.

[ticotaco72]

But for what is used that piece of code that you think causes it????

[basisbit]

For unpacking the files, installing the game, downloading the few example songs and then also adding a shortcut to the windows start menu. NSIS 3.0 installer is the part that MS security essentials detects falsely as virus every few months. In a few days, it will most likely stop detecting it as malware again, without anyone actually having changed that file.

[Swimburger]

Windows defender is still detecting a trojan in the installer.

[vmichalak]

In 2019 also.

[michaelgosling]

Still flags as this.

I'm sorry, @basisbit , your response to trojan concerns is to say "don't use snake oil"? You don't think that's a bit aggressive and dismissive? if NSIS flags as a false positive, maybe migrate from using an install helper last updated in 2016.

[basisbit]

@michaelgosling nsis is actively in development - just don't rely on the dead sourceforge website.
Whenever there is a new release of USDX being made, the most recent version of NSIS will be used. I just fear that MS will flag the usdx installer as malware again for political reasons. Mirosoft defender so far is the only engine whining about possibly detecting something - and even that only happens when using the in-memory scanner, but all is fine for Defender on-demand scanner and also all the other major AV products are fine. See https://www.virustotal.com/gui/url/8cc4aa18e7b3c1938587fb5d15cc59819cf9526e1346409ac6f2ab8906283eef/detection

I tried many times to report this as false flagged - and it sometimes was not flagged any more for a few weeks.

[michaelgosling]

I assume it's because of the method NSIS uses to install. Is it not possible to migrate to another installer or build your own method? Obviously its not an easy task but with Windows being so ubiquitous people are bound to encounter this a lot and come searching for solutions (or simply deleting it).

It was easy enough to tell Microsoft Defender not to flag it and then re-download it, but it might be helpful if you at least left this issue open and tagged it as a Known Issue. Just a suggestion.

Thanks for your timely and detailed response, it's appreciated. I'm sure you deal with this issue a lot.

[basisbit]

Created an issue to build a new usdx release using some installer that does not get falsely detected as malware by Microsoft Defender. The next release is mostly only waiting for usdx theme changes and some repository / documentation cleanup, but because of lack of free time, this might still take a while.

[carsten-engelke]

Still a problem with 2020.04

[basisbit]

@carsten-engelke can not confirm and virustotal.com also says that it is not falsely "detected" as possibly being malware. We used the newest version of the nsis installer, which is also used by many other open source software projects out there.

[basisbit]

what antimalware software do you use @carsten-engelke ?

[basisbit]

see https://www.virustotal.com/gui/file/08a24e46d18ac82a1619344356ead18f0ef3e07987460936a92f26c84a666ac2/detection

[michaelgosling]

@basisbit I've done some reading and while NSIS is used a lot, maybe you might consider using InnoSetup instead? It seems to not have the same issue with false positives and is popular and free.

InnoSetup Homepage
Blog Post from another developer talking about moving to InnoSetup

I understand Windows Security is simply doing a poor job handling NSIS Installer but this could shush people like me who get frustrated and don't know any better and then come post here about it 😂

[basisbit]

does the "portable" version of usdx work for you or does it also get "detected"? https://github.com/UltraStar-Deluxe/USDX/releases/tag/v2020.4.0
Also, where did you download the USDX 2020.04 installer from?

[michaelgosling]

@basisbit thats a question for @carsten-engelke I suppose, I haven't tried the latest USDX installer myself. You had previously mentioned that it happens every few months though so I just wanted to propose a potential alternative, to save you the time and energy of dealing with these reports mostly.

[basisbit]

@carsten-engelke could you please respond to my previous question? what antimalware software do you use?`
I still can't resproduce this with any antimalware software which is available for me.