Virustotal

[KeryWT]

Can you explain this please?

[LunarOccultist]

Yeah what is this, I am uninstalling and waiting to see what the response is before updating.
Also when I first ran a scan with VirusTotal is didn't show, running the scan again it showed.

[Tropix126]

This is likely a false-positive. When I upload to VirusTotal, I the crowdsourced rules don't appear. Could you screenshot one of the rulesets?

[KeryWT]

Sure.

[Tropix126]

Since i'm not entirely familliar as to how VirusTotal operates and there doesn't seem to be any real documentation around these crowdsourced rules, i've asked the other maintainer (zere) about it since he manages the more internal electron aspects and install scripts. Will keep you updated. Feel free to check the source code for the time being; it's documented in the readme.

[Curtis-D]

It's entirely open source, so whilst there is a small possibility of there being a virus, it's extremely unlikely that Zack (who has been pushing out updates for BD for 2 or so years for free and in his own time) would now decide to add randsomware to BD.

It's a false positive and it happens, but if you're worried feel free to check the source or wait until someone who has programming knowledge to check it for you

[QuantumWarpCode]

Just to go through these, the YARA rule it matches is designed to detect PlugX in memory by matching roughly 30 bytes that this installer just happens to also place into memory. The Sigma rule for detecting Nibiru seems to be a false match to when BDD installer calls a process with the arguments listed in your screenshot, which happens to contain "-u" "-p" and "2656". The crowdsourced rule doesn't seem to bother to check if that number is at the end or if the argument is exclusively "-u" and not "-use-gpu."

[KeryWT]

Just to go through these, the YARA rule it matches is designed to detect PlugX in memory by matching roughly 30 bytes that this installer just happens to also place into memory. The Sigma rule for detecting Nibiru seems to be a false match to when BDD installer calls a process with the arguments listed in your screenshot, which happens to contain "-u" "-p" and "2656". The crowdsourced rule doesn't seem to bother to check if that number is at the end or if the argument is exclusively "-u" and not "-use-gpu."

A user on reddit said the same thing, I was just waiting for someone else to confirm it. https://www.reddit.com/r/antivirus/comments/mi05py/help_with_this_file/
So it is just a bad written rule, thanks everyone.

[Tropix126]

Issue closed unless anything else comes up.