Portable zip flagged as malicious

[robgazy]

UltraStarDeluxe-portable-2024.10.0.zip flagged as malicious

7/68 security vendors flagged this file as malicious
712f5cd4d60004c7702107b4e2d35febc503c5c579cf9c5f33993f84793672fd
UltraStarDeluxe-portable-2024.10.0.zip

[LeighBicknell]

The installer too

[s09bQ5]

Look what I found!!
https://docs.virustotal.com/docs/false-positive-contacts

[robgazy]

Windows Security blocks the file and will not install or extract.

Threat Blocked: Severe
Detected: Trojan:Script/Wacatac.B!ml
Status: Quarantined
Quarantined files are in a restricted area where they can't harm your device. They will be removed automatically.
Details: This program is dangerous and executes commands from an attacker.
Affected items: file: C:\Users\xyza\Downloads\UltraStarDeluxe-portable-2024.10.0.zip

[s09bQ5]

Please submit the file at https://www.microsoft.com/en-us/wdsi/filesubmission for malware analysis. I can't. I don't have a Microsoft account.

[basisbit]

Duplicate of #722 and #368 . It is super annoying, that big antimalware development companies don't test their stuff properly to avoid false detections of small software projects. This is a common problem that many small projects have to deal with when using installer tools like NSIS and similar, just because sometimes malware developers choose to also use the same installer tools.

[basisbit]

Please submit the file at https://www.microsoft.com/en-us/wdsi/filesubmission for malware analysis. I can't. I don't have a Microsoft account.

Done, and already got a response from a manual analyst:

At this time, the submitted files do not meet our criteria for malware or potentially unwanted applications. The detection has been removed. Please follow the steps below to clear cached detections and obtain the latest malware definitions.

1. Open command prompt as administrator and change directory to c:\Program Files\Windows Defender
2. Run “MpCmdRun.exe -removedefinitions -dynamicsignatures”
3. Run "MpCmdRun.exe -SignatureUpdate"
   Alternatively, the latest definition is available for download here: https://docs.microsoft.com/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus

So, hopefully in the next few days when people's computers update, it shouldn't falsely detect usdx installer or portable zip any more.

[barbeque-squared]

Thanks basisbit! I'll probably leave this ticket open until I can work the info in this ticket into the readme/wiki, as it appears to be a recurring issue. Maybe even figure out how to use the github issue templates.

Slightly off-topic / note to self: do any of these scanning services have some kind of API so that we can work at least the portable into the CI? Should be allowed to fail / pass with warnings (at least to start with) but some kind of scanning is still better than no scanning at all.

[cskinner74]

Two weeks later and still being flagged, even after performing the above update steps