Zettlr: [BUG] Windows installer for 1.6.0 blocked by Defender due to Trojan:Win32/Fuery.C!cl

[jinxremoving]

Description

The Zettler 1.6.0 Windows installer was scanned and blocked by Windows Defender:

• Antimalware Client Version: 418.20046
• Engine Version: 1.1.17000.7
• Antivirus Version: 1.315.1414.0
• Antispyware Version: 1.315.1414.0

Reproducing

1. Download Zettler 1.6.0 from here
2. Scan download with Windows Defender (if not automatic)
   Observed:
   

Expected behaviour

Zettlr installer passes virus and anti-malware scans

Platform

• OS and version: Windows 10, 1909 (OS Build 18363.836)
• Zettlr Version: 1.6.0
• Screen Resolution: 2560x1600

[boring-cyborg[bot]]

Thanks so much for opening up your first issue here on the repository! 🎉 We would like to warmly welcome you to the community behind the app! ☺️ We'll check in soon and have a look at your issue. In the meantime, you can check your issue and make sure it aligns with our contribution guidelines! Here's the comprehensive list:

Enhancements

An enhancement takes a feature and improves or alters its behaviour. Please make sure to argue how your proposition will aid non-technical text workers, and why it can't be emulated easily with other features or apps!

Feature requests

Feature requests introduce whole new features into the app. This requires a lot of work, so these might be turned down if the implementation costs supersede the benefits we expect to see from implementing it. Please do not be disappointed if that happens. It likely has nothing to do with your great request but simply with us and our missing resources!
You can of course always ask someone to implement this feature, because a PR with a working new feature has much higher chances of being merged! :)

Bug reports

Please note that one of the main reasons for why bug reports cannot be addressed is that there's not enough information for us to find and fix the bug you describe, so make sure you try to pinpoint the bug as close as possible.
The ideal bug report for us has two qualities:

1. The bug is always reproducible, at least within a certain context. 2. We know exactly what specifically goes wrong, and there is consensus on
   what should happen instead.

Please note that if you encounter behaviour that does not align with your expectations of what would happen, this might as well be simply intended behaviour and we need to simply _clarify_ why the behaviour is the way it is. This is not to be considered a bug and such issues may be closed! Suggest an enhancement instead!
But now, have a great day and thank you again!

[nathanlesage]

Would you mind dragging it through VirusTotal? I have a feeling that this one company may have not quite fixed their bug.

[pcrockett-pathway]

I had the same problem, but VirusTotal says it's ok. This isn't the first time I've had Windows Defender show me a false positive recently.

I'm willing to bet that using a code signing certificate would make these sorts of false positives less likely to happen. That would allow Zettlr to get into Microsoft's software "reputation" system. That costs money though. :(

Alternatively, it looks like a Zettlr developer can submit the installer EXE to the Windows Defender Security Intelligence portal to help fix false positives.

[nathanlesage]

That would allow Zettlr to get into Microsoft's software "reputation" system. That costs money though. :(

I already threw $300 to SSL.com for a certificate, and the current betas are code-signed — but not the 1.6. So reputation growth will begin from 1.7 onwards.

Alternatively, it looks like a Zettlr developer can submit the installer EXE to the Windows Defender Security Intelligence portal to help fix false positives.

Also thought about it but as I can't automate this I won't do it manually. Let's hope for 1.7!

[jimvine]

I have had the same notification from Windows Defender today. I have uploaded the 1.6.0 installer to the Microsoft site requesting they recheck it. The site gave me an option to do that as a home user, not needing any affiliation to the developer.

[jimvine]

I got a response from my Microsoft submission. Their "Final determination" was "Not malware". There were also comments:

Analyst comments:

We have removed the detection. Please follow the steps below to clear cached detection and obtain the latest malware definitions.

1. Open command prompt as administrator and change directory to c:\Program Files\Windows Defender
2. Run “MpCmdRun.exe -removedefinitions -dynamicsignatures”
3. Run "MpCmdRun.exe -SignatureUpdate"

Alternatively, the latest definition is available for download here: https://www.microsoft.com/en-us/wdsi/definitions

I tried following their steps. The -removedefinitions step failed with an error. I tried rescanning the installer and it said that the item had been skipped due to an exclusion. So, I don't know whether the situation is now resolved for all users, but it does at least look like Microsoft have accepted that the file is harmless, and hopefully that will feed into their assessments of future versions.

[nathanlesage]

Thanks for validating the installer! And let's hope that reputation will build quickly with the newly code-signed installers — if you want to help, the betas are already signed with the certificate, so they'll already count towards the goal of "reputation". I'm going to leave that issue up, as in 67 days it'll be automatically closed, but this way other users until then have a chance to actually see this issue and get help with this problem!