current version -- 2.0 is marked as infected with a trojan by Windows Defender
ajalexei opened this issue · 3 comments
Somehow the latest version of yori: yori-core-arm64.cab is marked as infected with a trojan by Windows Defender.
I am pretty sure this is a false positive, however still feeling obliged to report it here.
Thanks for the report. Do you have any screenshots or logs for this detection? I scanned everything with Defender now which didn't appear to find anything.
Can you also double-confirm this is arm64 not amd64?
Arm64: https://www.virustotal.com/gui/file/7f8293b17885583193e74430a1ff743d1d1a605363180c6cb3af5a1fe43e9e4e
Amd64: https://www.virustotal.com/gui/file/6ab7add993b8e9065c0997810139c3d2dbd48be9f0a1982235fbca5237302577
Do these hashes match the file contents you have?
Historically the Defender team have been fairly responsive to reports of overactive detection, but not all vendors are. It's not uncommon to see something like here where Arm64 is flagged by somebody based on a heuristic (as opposed to a thumbprint) and then that gets picked up as a kind of echo chamber.
Looking at the "relations" tab shows another AV vendor is detecting the ARM version of very trivial tools (title, cls, pause, mkdir, etc.) It makes me wonder a little what heuristic behavior malware today has (open console window, clear screen, update title, display message, wait for key press...?)
Thanks for a prompt reply.
Apologies for not replying at once -- it was a busy week for me. I confirm it was arm64. The issue is gone and seemed to be a false positive (as I suspected from the beginning).
It seems like there's nothing actionable left here. Let me know if there are future detections (which will happen - this is an ongoing ecosystem wide problem.)