False positives

[savchenko]

Situation seems to be spiralling a little out of control...

I have submitted "false-positive" reports to AVG, Avast and Microsoft¹, but this is more of a temporary measure. #155 should help, however as usual, "no guarantees implied". I propose the following:

1. Sign the application
2. Talk to AV vendors with explicit documentation that WSB is:
   1. Not a malware
   2. Open-Source
   3. Signed by a known certificate

I am willing to take care of "communicating with AV vendors" part if needs be. Thoughts?

1: https://www.microsoft.com/en-us/wdsi/submission/863043f5-0814-4047-8213-86325ee360e9

[crazy-max]

Hi @asvc,

I have submitted "false-positive" reports to AVG, Avast and Microsoft

Looks like it's solved for Microsoft now, thanks for your input.

1. Sign the application
2. Talk to AV vendors with explicit documentation that WSB is:
   1. Not a malware
   2. Open-Source
   3. Signed by a known certificate

This is definitely a good move! I will try to bring people here who have had this kind of issue with AV vendors. If you have more information, they are welcome!

[savchenko]

Minus one:

Re: Avast: False positive file WindowsSpyBlocker.exe [ ref:_00Db0Z3Sf._5000N1y33qn:ref ]
Our virus specialists have been working on this problem and the provided file has been whitelisted.

[crazy-max]

Everything looks fine now :)

[zeldaboch]

more false positive for 4.26.0 ?
https://www.virustotal.com/gui/file/e090a29a356ed235c872f2a2ec63d0216c23ce5b0fc38ff00aa8641e3fa3fb62/detection

[luixxiul]

@crazy-max I know these are false detections (and were confirmed so by antivirus vendors), but on Chocolatey there are false ones two times in a row (for 4.27.0 and 4.27.1). Do you mind letting me know if you have a clue to prevent false detections? Thanks!

[0lm]

4.28.1 also got false positive now, by windows defender

[hl2guide]

Continuing for 4.34.0:
Trojan:Win32/Wacatac.D1!ml

[Carterpersall]

Continues for 4.34.2:
Flagged by SmartScreen on new Edge
I reported it as a false positive

[BigBroza]

@crazy-max why don't you remove what is causing these false positives? surely you have an idea what it is causing these heuristic detection, do you compress the exe too much resulting in high entropy?