Clemens 0.6 malware detected or not?

Question

Clemens 0.6 malware detected or not?

dor73 opened this issue a year ago · 4 comments

Version 0.6 Clemens downloaded from the releases page. No problem with Windows Defender (Windows 10 64bit), but detected 1 malware (Bkav Pro W32.AIDetectMalware.64) with VirusTotal online. Maybe it's a false positive.?

Answer 1 · 2023-08-27T21:36:29.000Z

The executable was built on a GitHub runner and copied to a macOS device that was later uploaded to the release page. This is the job that generates the exe in a zip archive.

https://github.com/samkusin/clemens_iigs/actions/runs/5892110026

I'll investigate whether another build yields the same results.

I've seen this particular malware flagged as a false positive in other cases. But I can't authoritatively say this is a false positive without more context. I've ran this executable through other "top" online file checkers like Opentip, jotti, and Internxt with no malware found - though VirusTotal is usually the best of these checkers.

Answer 2 · 2023-08-28T19:42:15.000Z

This recent thread from less than a week back as of this writing talks about several false positives found with VirusTotal including W32.AIDetectMalware.64 found by Bkav Pro at the top of the list.

Again, I can't say 100% this is a false positive but given the circumstances around how this app was built given above, I believe it is. Also, Bkav Pro is not one of the major antivirus software suites.

reddit.com/r/antivirus/comments/15zku92/virustotal_identified_possible_malware_in_my_gpus/

Answer 3 · 2023-08-31T12:13:38.000Z

thanks for your reply, probably is a false positive. as soon as i have some time i will try to compile it for Windows and check if there is the same problem. Yesterday I checked on VirusTotal the Macintosh version in .dmg. This version has no flags. Thank's for your job. A tip: it would be useful to have the monochrome option in both BW and Green and Amber phosphors with specific buttons on the window.

Answer 4 · 2024-04-28T18:03:24.000Z

Seems this is a false positive. Getting these removed from Windows builds without using a cert may not be worth the cost. As mentioned above that one check seems to be the only one that reports a virus and has been the source of other false positives.