Trojan detected for Ventoy2Disk.exe

[luketanti]

When extracting on windows, the Ventoy2Disk.exe is getting flagged and deleted by McAfee

Is this false positive?

I have also checked on VirusTotal and attached a screenshot

[JinGWme]

I second this.
McAfee delete main exe file upon download finishes.

[HarmVeenstra]

Same goes for Sophos Endpoint Protection

[boomschtick]

The detections on VirusTotal is up to 19. I ran the app in Windows Sandbox and didn't see anything wrong, but the detection rate is concerning for people who care to look.

https://www.virustotal.com/gui/file/231711f3b7c6adc5567b154dcc480c204cd8116808bbe10512729d0be68b57f0/detection

[xfrankbx]

Same for Bitdefender. Says it found Trojan.GenericKD.33781261 in the zip file.

[luketanti]

@ventoy can you please have a look about this please?

[ventoy]

@luketanti

Currently I have no idea about this.
Ventoy2Disk.exe is open source. You can compile it from the source by VisualStudio.
So I don't known why it is denied by these antivirus software.

Any suggestions?

[boomschtick]

There has to be some kind of behavior in the code that the AV's don't like to see. Either that or you have used source code that was used previously in some kind of malware.

That's my best guess.

[RudiKlein]

Hi,
Maybe the message I got from Acronis Active Protection (module of Acronis True Image 2020) could shine some light on this. It blocks the Ventoy2Disk.exe with the message: Possibe ransomware detected. Acronis Active Protection paused the program that tried to modify your Master Boot Record". That might be a hint.

[jsamr]

@ventoy I dig into support channels. Here is a list, you could submit reports to be whitelisted! I picked all false positive vendors from Virus Total.

• SecureAge APEX: https://www.secureaplus.com/features/antivirus/report-false-positive
• eGambit: https://tehtris.com/egambit_fp.php

EDIT1: I removed the false positives reported by older VT submissions
EDIT2: Only two anti-virus solutions flag the 1.0.12 version as malware

[Riz-waan]

Hi, what about for windows defender?

[tonyd85]

Acronis claims it modifies the Master Boor Record. Of which disk, Acronis is yet to say. However, Acronis is kind enough to bug out for 30 minutes before finally blocking it. Edit: Then Acronis actually failed to block it. Better look up my build number before I post on their forums...

[tonyd85]

yeah the behavior is not using DLL injection to get past AV. lmao

[jimmihenry]

Windows Defender found and kicked the Ventoy.exe, pointing out Trojan:Win32/Phonzy.C!ml. Ver.1.0.58
Cheers

[petrus9]

Just tested ventoy-1.0.81-windows.zip on virus total and got one flag: Trojan.Malware.300983.susgen by MaxSecure