Avast reports portable version full of viruses

[UserXYZ]

When I download and run the 64bit portable version of FitViewer (which works great BTW), my Avast and Windows Defender report it as being populated by malware/trojan/IDP crap.

Is it possible to verify if this is true, or at least provide an explanation why they do trigger warnings and block the file?

Thank you.
Andrea

[Nick2bad4u]

Can you send me a screenshot of what it gets blocked for?

All the binaries are unsigned so sometimes anti-virus freaks out because of it.

I can assure you there's no malware or viruses, in fact, the app is completely network free (can be used with no internet connection, you just lose some map functionality) and only ever contacts the network to upload chart image exports to gyazo / imgur and pull map data

[UserXYZ]

Hi Nick, here's what my Avast reports:
Threat name: FileRepMalware [Trj]
Threat type:
Trojan Horse - This threat pretends to be something else (e.g.,
picture, document, or other file) to trick you into running it and
infecting your computer.

It catches it and blocks the minute I start the app, but not when I download it...so it has to be something with how you create process/window/whatever...I'm just spitballing here... :)

Anyway, I can only use the app if I create an exception, but that should not happen - hence my request to see in your code or logic why Avast would trigger.

Chers, Andrea

[Nick2bad4u]

Thanks, that helped. I dug into the actual 30.0.1 portable build and found the cause.

The main FitFileViewer exe is clean on VirusTotal (0/75), but the portable build accidentally includes a Squirrel helper called Fit File Viewer_ExecutionStub.exe that it does not use. That helper is getting 19/73 detections. The portable version unpacks itself to a temp folder when it starts, so Avast only sees and blocks the helper at that point. You were right that it was tied to startup, just not the window/process code in the app itself.

The release is also unsigned, which makes reputation warnings worse, but there is a real packaging mistake here too. I am removing Squirrel completely since FitFileViewer uses the NSIS updater anyway, then I will rebuild it and put out a fixed release. You should not have to whitelist it.

I also need to correct my earlier comment: the app checks GitHub for updates when it starts, along with the map and optional image upload requests I mentioned. Forgot about the auto-updater 😬

I could not reproduce the Defender detection locally; Defender scanned both the portable file and its extracted contents clean. If Defender still flags the fixed release, please send the exact Defender detection name or a screenshot too.

Thanks for reporting this.

[Nick2bad4u]

The fixed release is live now: FitFileViewer v30.0.2. The direct 64-bit portable download is here.

I removed Squirrel.Windows from the Windows packaging. I also downloaded that exact published portable EXE and unpacked both of its nested layers: it no longer contains the squirrel-windows output, Squirrel.exe, a .nupkg, or Fit File Viewer_ExecutionStub.exe. Microsoft Defender found no threats in either the downloaded EXE or its fully extracted contents, and the published upgrade/startup smoke test passed.

The portable EXE's SHA-256 is E967956F8F4363F7EB0158708F82C5BBF928A0402510C8A829415911C615E098. It was also successfully submitted to VirusTotal for analysis.

One caveat remains: the Windows binaries are still unsigned, so Avast can still apply a low-reputation/FileRep warning to a brand-new release. However, the specific unused helper that was generating the much stronger detections in 30.0.1 is gone.

Could you please try the new x64 portable build without the old exception and let me know what Avast says? If it still blocks it, send the new detection name plus the filename or a screenshot and I will keep digging. Thanks again for catching this.

[UserXYZ]

Hey Nick, thanks for diggin in this - I just got the new portable version you've put and tested it.
Direct scan after download does not complain, but once I ran the binary, my Avast started scanning it as suspicious and came up with this:

I'll send it to their threat lab to see what it says, and wil give you back the result.
I hope they won't complain about it.

Cheers, Andrea