windows defender goes vrooom on the zip

[monsdroid]

checked with virustotal.com

any chance to resolve this?

[monsdroid]

btw, extracted there is no problem. probaly a checksum coincidence ont the zip?

[irusanov]

@monsdroid I have investigated yesterday, it appears to be from one single array in the code. It was fine first I uploaded it on release date, but definitions probably updated couple of days ago.

It didn't like this particular block of code (with it reworked, it is down to 2 false-positives):
493ee05

There's still one more detection compared to 1.2.7 exe (2 vs 1) which I haven't found yet.
I'm not sure what to do in this case, would probably need to re-release 1.2.8 with some explanation (maybe a video) so people don't get worried.

[irusanov]

1.2.7 recompiled from source: https://www.virustotal.com/gui/file/23aaea7ce1a96af5049d1f8686514a16e6892b5617bfab2b52aa1aa28da3bc3a?nocache=1

1.2.8 recompiled from source:
https://www.virustotal.com/gui/file/742490d2d9ea7f128ff379b7d9e5b89de4c56eec8c4c6b3ff6fdd528562c582d?nocache=1

1.2.8 with removed the conflicting code block
https://www.virustotal.com/gui/file/67c69c2554bafec16b5a70593701e97727c13425da43a05c70e4ec06771d4118?nocache=1

1.2.8 from master that includes the latest commit (same code block, but rewritten)
https://www.virustotal.com/gui/file/9c5721991526d06f64826dbb63210a2de797cb4824337871189dd0ee3e5af791?nocache=1

[irusanov]

New version released and it seems to be "fine" for now. There are still 2 detections on the executable and 2 on the whole zip.
One on the zip is coming from the included WinIO driver (only used for 32bit OS). Still not sure what causes the remaining 2 false-positives for ZenTimings.exe. I doubt it would be easy to workaround these, as the application needs to read memory, PCI registers, WMI, etc.

PS: Actually it is just 1 now for the exe.