virustotal detections

[SynapseScribe]

https://www.virustotal.com/gui/file/13484d5dcc1fe6f1d50a4dc11c251376f603fdd85abfafce68858c7787b34df4

[benbuck]

Hi @Uj947nXmRqV2nRaWshKtHzTvckUUpD,

Thanks for reporting this. Interestingly, VirusTotal doesn't flag the Finestray standalone executable, only the installer exectuable. I currently don't have any idea why, and am assuming that these must be false positives, but I'll try to investigate further to see if there's a way to eliminate these.

Benbuck

[benbuck]

I just filed false positive reports with all the vendors from VirusTotal that flagged the Finestray installer.

[SynapseScribe]

I just filed false positive reports with all the vendors from VirusTotal that flagged the Finestray installer.

nice. i see on v0.2 there's a new Bkav's AI detection https://www.virustotal.com/gui/file/d366c245aaf2d03959d53e259b05b7740a40426adb880634efec5cc51703832e

is the installer custom made or do you use any specific wizard? it's kind of strange.. i'd expect both to have the same detections

[benbuck]

Hi @Uj947nXmRqV2nRaWshKtHzTvckUUpD,

I'm just using the standard Nullsoft (NSIS) installer, driven by standard CPack (from CMake):

https://github.com/benbuck/finestray/blob/main/CMakeLists.txt#L257-L280

I really have no idea what those detections are finding that raises any flags.

-Benbuck

[benbuck]

I just got a response from SecureAge acknowledging that their detection is a false positive and should be cleared within three days.

-Benbuck

[benbuck]

I just got a response from Bkav acknowledging that their detection was a false positive and has been fixed.

-Benbuck

[benbuck]

For version 0.2, SecureAge and Bkav are no longer showing false positives. I haven't heard back from Cylance or Skyhigh yet.

-Benbuck

[benbuck]

I haven't heard back from Skyhigh, but it looks like their false positive for version 0.2 was removed anyway, leaving only Cylance.

-Benbuck

[SynapseScribe]

strange, i see SecureAge only now on the latest ci build https://www.virustotal.com/gui/file/11f8e2947dd1d66cf2d14ce18df6593482996a9daad1d6f63dca60ec89eea1e6/detection

[benbuck]

Hi @Uj947nXmRqV2nRaWshKtHzTvckUUpD,

Yeah, it seems like the results from these particular vendors aren't particularly reliable. I'll leave this open though for now, hopefully everything will clear up soon.

-Benbuck

[benbuck]

I just released version 0.3, and now all the old false positives are showing up again, so it looks like I'll have to go through the process of contacting the vendors again.

https://www.virustotal.com/gui/file/34e50cd3045cb95629b21bb8bd046f0015e3cbc7379d9eaf870c056af4540370

-Benbuck

[SynapseScribe]

when using Nullsoft (NSIS) installer to pack anything, does it also show as detections? or only when packing your binaries?

[benbuck]

Hi @Uj947nXmRqV2nRaWshKtHzTvckUUpD,

That's a good insight, and yes even the most basic possible NSIS installer seems to trigger most of the same detections. Here's the project:
https://github.com/benbuck/install-test

And here's the build it generated:
https://github.com/benbuck/install-test/actions/runs/13851443659

And here's the VirusTotal results:
https://www.virustotal.com/gui/file/895b108fbb12dbaa031e4861a841a4982150e8e5ddbbb573b25f7bdc5ab23732

-Benbuck

[SynapseScribe]

i asked AI and cpack seems to allow use of wix toolset to generate exe installers (it's also open source). (i am not a windows developer). Could be worth a shot
https://cmake.org/cmake/help/latest/cpack_gen/wix.html

By the way, the nsis compiler 3.11 itself shows as having detections... (https://sourceforge.net/projects/nsis/files/NSIS%203/)
https://www.virustotal.com/gui/file/38d49f8fe09b1c332b01d0940e57b7258f4447733643273a01c59959ad9d3b0a

However it's pretty obvious that those particualr AVs are incorrectly detecting them.

[benbuck]

Hi @Uj947nXmRqV2nRaWshKtHzTvckUUpD,

Yeah, I have experimented with WIX for these reasons, and there's a few things I don't like about it, but really the blocker is that I can't get it to install to the right place by default. If I can figure that out, I'll consider switching.

-Benbuck