Windows 10 report virus Trojan:Win32/Bulta!rfn of Uninstall xxx.exe #4793

tangjfn · 2020-03-17T23:29:03Z

Version: 22.4.1

4.2.5

Target: win32 x64 nsis-web

Windows 10 1909 18363.720

electron-builder execute fail, because windows has deleted the uninstall.exe

22.3.6 is OK

baryon · 2020-03-18T10:10:35Z

I have same issue. Trojan:Win32/Bulta!rfn

Kyusung4698 · 2020-03-19T19:33:06Z

Same Issue. My NSIS installer got blocked.

Kyusung4698 · 2020-03-19T22:03:33Z

Hi, I've submitted a flagged version of my installer as false positive to Microsoft. I'll keep you updated.

Kyusung4698 · 2020-03-20T07:54:29Z

Update: Microsoft has removed/ approved the false detection. Please see following submission:
https://www.microsoft.com/en-us/wdsi/submission/69113a4a-0fc7-423d-80ad-f6ed0cf128ad

They'll roll out a new definition file of the Windows Defender soon which will prevent this false flagging.

adriencohen · 2020-03-27T10:15:11Z

I have submitted my own uninstaller too, they approved the false detection and it worked. However after rebuilding a new version of my app the uninstaller was detected again. Looks like we are going to need to pinpoint the commit which added this

Edit: It comes from version 22.4.0

lutzroeder · 2020-03-28T19:46:46Z

@develar could the update to nsis 3.0.4.2 in 4e454f8 have caused this?

4e454f8b4 packages/app-builder-lib/src/targets/nsis/nsisUtil.ts      (develar             2020-03-03 13:48:34 +0100  22)   return getBinFromUrl("nsis", "3.0.4.2", "o+YZsXHp8LNihhuk7JsCDhdIgx0MKKK+1b3sGD+4zX5djZULe4/4QMcAsfQ+0r+a8FnwBt7BVBHkIkJHjKQ0sg==")

edward-buskus · 2020-04-01T06:49:18Z

I have same issue. Is there any solution for this problem?

develar · 2020-04-01T06:59:02Z

NSIS updated to 3.0.5, maybe Windows Defender will be more happy with this version. electron-builder will be released soon.

edward-buskus · 2020-04-01T09:04:48Z

deleteAppDataOnUninstall: false helped me at the moment.

develar · 2020-04-01T10:08:41Z

Please try 22.5.0

awlx · 2020-04-01T10:31:27Z

22.5.0 doesn't produce a build anymore:
https://ci.appveyor.com/project/awlx/jitsi-meet-electron/builds/31874856

Close electron-userland#4793

develar · 2020-04-02T07:11:40Z

I don't have time today to investigate what's wrong with building on Windows using a new version of NSIS.

So, reverted to 3.0.4.1 as a quick solution.

See electron-userland/electron-builder#4793

Close electron-userland#4793

…n-builder#4793

Reverts to electron builder 22.3.6 to avoid electron-userland/electron-builder#4793

indutny-signal · 2021-07-30T18:31:43Z

It has been a year since initial report. Should NSIS version be reverted back to 3.0.5.0 now?

indutny-signal · 2021-09-16T19:25:26Z

Friendly ping. The new NSIS build shouldn't trigger the antivirus anymore, so I think we could try bumping it up again.

JCMais · 2021-11-15T15:54:50Z

This seems to be happening again on the latest version.

indutny-signal · 2021-11-15T17:38:08Z

I don't believe nsis version was changed since September: https://github.com/electron-userland/electron-builder/commits/master

vnicolici · 2021-11-24T14:33:51Z

I have a similar problem with an install.exe file coming from an Electron app: https://i.imgur.com/Cxj1weh.png

dclipca · 2021-12-02T15:11:51Z

https://i.scdn.co/image/ab67616d0000b273950359444321d635b59838b3

dclipca · 2021-12-02T15:50:36Z

Updating to electron-builder 22.14.10 fixes the issue because it has NSIS 3.0.4.1.

BarryCarlyon · 2022-01-05T16:29:29Z

This one is rearing it's head again in the last couple of hours when trying to build.

On the uninstaller no less....

using 22.14.5 (NPM latest) on windows.

ErikMach · 2022-01-06T01:19:47Z

@BarryCarlyon I had the same problem with version 22.14.5.
But I just used 22.14.12 and it worked fine.

BarryCarlyon · 2022-01-06T01:21:48Z

@ErikMach since 22.14.12 isn't on NPMJS I tried to intall it via github and got a weird "this is not a mac" error on my windows machine. So I'll need to dig about with that further.

ErikMach · 2022-01-06T01:26:41Z

I installed it via npm with the command npm install --save-dev electron-builder@22.14.12

BarryCarlyon · 2022-01-06T01:27:17Z

I'll give it a poke :-D

This should fix the false positive virus detection by Windows Defender See electron-userland/electron-builder#4793

Microsoft Defender considers the uninstaller virus. It's a false-psoitive caused by `electron-builder` used to build NSIS package. This commit solves the issue by explicitly adding `electron-builder` as dependency. This way, `vue-cli-plugin-electron-builder` always resolves to the desired version. Now the version used for `electron-builder` is more controlled. New uninstaller generated by latest specified patch does not trigger an alert, which solves the false-positive issue. See also : - electron-userland/electron-builder#4793, - electron-userland/electron-builder#4878.

Microsoft Defender considers the uninstaller virus. It's a false-psoitive caused by `electron-builder` used to build NSIS package. This commit solves the issue by explicitly adding `electron-builder` as dependency. This way, `vue-cli-plugin-electron-builder` always resolves to the desired version. Now the version used for `electron-builder` is more controlled. New uninstaller generated by latest specified patch does not trigger an alert, which solves the false-positive issue. See also: - electron-userland/electron-builder#4793, - electron-userland/electron-builder#4878.

koyuawsmbrtn · 2022-03-25T11:20:56Z

Still an issue with the latest release of electron-builder. Issue can be reopened.

egeres · 2022-04-14T07:31:36Z

Same issue happening here!

augustnmonteiro · 2022-05-23T20:27:11Z

Same here as well

augustnmonteiro · 2022-05-23T20:27:58Z

When we send and update to the users, it gets uninstalled but it doesn't get installed again.

Going to force use of 22.14.12 as for now

augustnmonteiro · 2022-05-23T20:42:12Z

@develar can we reopen this one?

joehinkle11 · 2022-09-12T14:33:57Z

I have the same issue on on 23.3.3. I just started investigating it.

Microsoft Defender considers the uninstaller virus. It's a false-psoitive caused by `electron-builder` used to build NSIS package. This commit solves the issue by explicitly adding `electron-builder` as dependency. This way, `vue-cli-plugin-electron-builder` always resolves to the desired version. Now the version used for `electron-builder` is more controlled. New uninstaller generated by latest specified patch does not trigger an alert, which solves the false-positive issue. See also: - electron-userland/electron-builder#4793, - electron-userland/electron-builder#4878.

johannesjo mentioned this issue Mar 26, 2020

5.0.0 Windows Defender gives Trojan:Win32Bulta!rfn warning johannesjo/super-productivity#315

Closed

lutzroeder mentioned this issue Mar 28, 2020

Windows Defender detects uninstaller for 4.0.0 as virus lutzroeder/netron#452

Closed

lutzroeder mentioned this issue Apr 1, 2020

Revert to nsis 3.0.4.1 (#4793) #4830

Closed

develar added the nsis label Apr 1, 2020

develar closed this as completed Apr 1, 2020

develar reopened this Apr 2, 2020

develar added a commit to develar/electron-builder that referenced this issue Apr 2, 2020

fix(nsis): revert to 3.0.4.1

49dc9b8

Close electron-userland#4793

develar added the investigate label Apr 2, 2020

develar closed this as completed in 9c43cc3 Apr 2, 2020

morguldir added a commit to morguldir/awakened-poe-trade that referenced this issue Apr 3, 2020

Set electron-builder version to 22.5.0 to avoid antivirus problems

6ad1816

See electron-userland/electron-builder#4793

morguldir mentioned this issue Apr 3, 2020

Set electron-builder version to 22.5.0 to avoid antivirus problems SnosMe/awakened-poe-trade#67

Closed

awlx mentioned this issue Apr 6, 2020

Merge changes upstream jitsi/jitsi-meet-electron#225

Closed

BusinessDuck pushed a commit to BusinessDuck/electron-builder that referenced this issue Apr 12, 2020

fix(nsis): revert to 3.0.4.1

e8690e5

Close electron-userland#4793

mvdicarlo mentioned this issue Apr 13, 2020

Winx64 uninstaller detects as treat by WinDefender mvdicarlo/postybirb#26

Closed

gre added a commit to gre/ledger-live-desktop that referenced this issue Apr 16, 2020

Revert to older electron-builder because of electron-userland/electro…

907684d

…n-builder#4793

gre mentioned this issue Apr 16, 2020

Fixes windows virus false-positive issue due to electron-builder LedgerHQ/ledger-live-desktop#2860

Merged

gre added a commit to gre/ledger-live-desktop that referenced this issue Apr 16, 2020

Revert to older electron-builder because of electron-userland/electro…

10853b6

…n-builder#4793

gre mentioned this issue Apr 17, 2020

Ledger Live 2.1.0, 2.2.0, 2.2.3 Installers and Uninstallers for Windows are triggering Windows Defender with Trojan:Win32/Bulta!rfn detection LedgerHQ/ledger-live-desktop#2822

Closed

Farrser added a commit to AvolitesLtd/TitanManual that referenced this issue Jul 22, 2020

Revert version of electron builder to fix antivirus issue

d352ea4

Reverts to electron builder 22.3.6 to avoid electron-userland/electron-builder#4793

Bilb mentioned this issue Jul 28, 2021

Windows 1.6.7 installer, trigger antivirus software euristics. oxen-io/session-desktop#1771

Closed

LFBarreto mentioned this issue Sep 16, 2021

LL-7231 change app logo and splashscreen LedgerHQ/ledger-live-desktop#4221

Merged

4 tasks

rse mentioned this issue Oct 12, 2021

Windows Security reports Trojan:Win32/Bulta!rfn on Vingester 2.6.6 rse/vingester#54

Closed

moughxyz mentioned this issue Dec 9, 2021

[Windows] Trojan:Win32/Bulta!rfn Windows Defender Detected on 3.9.8 standardnotes/desktop#795

Closed

undergroundwires mentioned this issue Jan 8, 2022

[BUG]: Windows Defender Detects Uninstaller as a Virus undergroundwires/privacy.sexy#114

Closed

danielgarthur added a commit to neanes/neanes that referenced this issue Feb 3, 2022

Upgrade electron-build

9f05b34

This should fix the false positive virus detection by Windows Defender See electron-userland/electron-builder#4793

jrobinso mentioned this issue Feb 7, 2022

Windows Defender quarantines "Uninstall IGV JBrowse CircularView.exe" igvteam/circular-view-app#19

Closed

xhyrom mentioned this issue Apr 16, 2022

Trojan ._. Garlic-Team/powercord-installer#1

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Windows 10 report virus Trojan:Win32/Bulta!rfn of Uninstall xxx.exe #4793

Windows 10 report virus Trojan:Win32/Bulta!rfn of Uninstall xxx.exe #4793

tangjfn commented Mar 17, 2020 •

edited

Loading

baryon commented Mar 18, 2020

Kyusung4698 commented Mar 19, 2020 •

edited

Loading

Kyusung4698 commented Mar 19, 2020

Kyusung4698 commented Mar 20, 2020 •

edited

Loading

adriencohen commented Mar 27, 2020 •

edited

Loading

lutzroeder commented Mar 28, 2020

edward-buskus commented Apr 1, 2020

develar commented Apr 1, 2020

edward-buskus commented Apr 1, 2020 •

edited

Loading

develar commented Apr 1, 2020

awlx commented Apr 1, 2020

develar commented Apr 2, 2020

indutny-signal commented Jul 30, 2021

indutny-signal commented Sep 16, 2021

JCMais commented Nov 15, 2021

indutny-signal commented Nov 15, 2021

vnicolici commented Nov 24, 2021

dclipca commented Dec 2, 2021

dclipca commented Dec 2, 2021

BarryCarlyon commented Jan 5, 2022 •

edited

Loading

ErikMach commented Jan 6, 2022

BarryCarlyon commented Jan 6, 2022 •

edited

Loading

ErikMach commented Jan 6, 2022

BarryCarlyon commented Jan 6, 2022

koyuawsmbrtn commented Mar 25, 2022

egeres commented Apr 14, 2022

augustnmonteiro commented May 23, 2022

augustnmonteiro commented May 23, 2022 •

edited

Loading

augustnmonteiro commented May 23, 2022

joehinkle11 commented Sep 12, 2022

Windows 10 report virus Trojan:Win32/Bulta!rfn of Uninstall xxx.exe #4793

Windows 10 report virus Trojan:Win32/Bulta!rfn of Uninstall xxx.exe #4793

Comments

tangjfn commented Mar 17, 2020 • edited Loading

baryon commented Mar 18, 2020

Kyusung4698 commented Mar 19, 2020 • edited Loading

Kyusung4698 commented Mar 19, 2020

Kyusung4698 commented Mar 20, 2020 • edited Loading

adriencohen commented Mar 27, 2020 • edited Loading

lutzroeder commented Mar 28, 2020

edward-buskus commented Apr 1, 2020

develar commented Apr 1, 2020

edward-buskus commented Apr 1, 2020 • edited Loading

develar commented Apr 1, 2020

awlx commented Apr 1, 2020

develar commented Apr 2, 2020

indutny-signal commented Jul 30, 2021

indutny-signal commented Sep 16, 2021

JCMais commented Nov 15, 2021

indutny-signal commented Nov 15, 2021

vnicolici commented Nov 24, 2021

dclipca commented Dec 2, 2021

dclipca commented Dec 2, 2021

BarryCarlyon commented Jan 5, 2022 • edited Loading

ErikMach commented Jan 6, 2022

BarryCarlyon commented Jan 6, 2022 • edited Loading

ErikMach commented Jan 6, 2022

BarryCarlyon commented Jan 6, 2022

koyuawsmbrtn commented Mar 25, 2022

egeres commented Apr 14, 2022

augustnmonteiro commented May 23, 2022

augustnmonteiro commented May 23, 2022 • edited Loading

augustnmonteiro commented May 23, 2022

joehinkle11 commented Sep 12, 2022

tangjfn commented Mar 17, 2020 •

edited

Loading

Kyusung4698 commented Mar 19, 2020 •

edited

Loading

Kyusung4698 commented Mar 20, 2020 •

edited

Loading

adriencohen commented Mar 27, 2020 •

edited

Loading

edward-buskus commented Apr 1, 2020 •

edited

Loading

BarryCarlyon commented Jan 5, 2022 •

edited

Loading

BarryCarlyon commented Jan 6, 2022 •

edited

Loading

augustnmonteiro commented May 23, 2022 •

edited

Loading