-
Notifications
You must be signed in to change notification settings - Fork 786
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Virus Trojan:Win32/Tnega!MSR report from Microsoft Defender on v1.2.2 release #5378
Comments
I'm not familiar with the building process and I'm not a Windows user so I cannot say if it is a false positive or not. For some additional context, I tested with VirusTotal other versions of Xournal++ for Windows. These are the results: |
FYI anyone interested in a working product regardless of potential security risks, |
Thanks @eldipa for the reports. The official release builds are automatically built on Microsoft's Azure Pipelines from source and Microsoft defender is the only one complaining about a Trojan contained in the Windows installer. All the binaries for the 1.2.2 release have the same timestamp (Oct 14, 12:43 PM GMT+2), so it doesn't look like someone uploaded a different installer than the one built on Azure Pipelines. Unfortunately the assets built on Azure Pipelines are only stored for a couple of days, so we can't check directly if the file has been modified in the meantime. The nightly build has a clean report by the way. So maybe use the nightly build if you are worried that the 1.2.2 installer might be infected. |
(I think) I launched a new build of the 1.2.2 version |
The portable version is also unflagged: https://www.virustotal.com/gui/file/80532b9b153bf73fc7bb240543760ba4b7b797a7ca811ba8782f0e85e4134095 |
The newly generated artefact is clean, according to Virustotal |
You can find the artefacts here: |
Does anyone know how to replace the artefact on the release page? |
Indeed you can! (but it does not work if the new asset has the same name as the one you remove. You need to apply your changes and then rename the new artefact) |
Thank you all! I can confirm that the latest windows version is clean. |
Hello, i'm gonna use this thread while it is still open instead of creating a new one
|
Most likely a false positive. We can't do much about it, unfortunately, the antivirus vendors analyze files in their cloud, and when they detect code paths, which are similar to those used by truly malicious software, the AI may classify the file as malicious too. Steps you can do: https://www.microsoft.com/en-us/wdsi/defenderupdates Sources for false positive: |
Operating System
Windows
(Linux only) Distribution
No response
(Linux only) Desktop Environment
No response
(Linux Only) Display Server
None
Installation Method
Official release exe (not portable)
Xournal++ Version
1.2.2
libgtk Version
3.24.39
Bug Description
Windows defender reports the installer as a malicious file (Trojan:Win32/Tnega!MSR).
I have tested on virustotal and Trapmine also reports the installer as malicious. Is this a false positive?
Thanks!
Expected Behaviour
The installer is reported as safe.
Steps to Reproduce
Download the windows installer zip file
extract the exe
Windows Defender outputs the warning
Additional Context
No response
The text was updated successfully, but these errors were encountered: