Trojan detected by Windows and VirusTotal

[Elip100]

I was using Bosca Ceoil Blue as usual when randomly Windows Defender gave me a notification saying it had detected libgdsion.windows.template_release.x86_32.dll as Trojan:Win32/Pomal!rfn. I then ran the file through VirusTotal and was surprised to see that 23/72 security vendors flagged it as malicious. While most of them couldn't agree on what exactly it was, most said trojan.bm8rctf (which for some reason I can't find any Google results for). I would assume these are false positives due to the fact that it is fully open source, but regardless it's still probably an issue if it is always being flagged. I can't tell if this is an issue with Bosca Ceoil or GDSiON, but I figured I would report it here as @YuriSizov made both anyways.

[Elip100]

This may be an issue with Godot, as it's docs state, "On Windows, PCK embedding is also known to cause false positives in antivirus programs. Therefore, it's recommended to avoid using it unless you're distributing your project via Steam as it bypasses code signing and antivirus checks." (found here)

[YuriSizov]

Hey there! These are indeed false positives caused by faulty heuristics in virus detection software (I believe that's exactly why a lot of matches are marked with Heur). There isn't much I can do about that since this is basically some sequence of bytes looking like one of the entries in their databases. This happens all the time, though I guess code signing the files would help a bit. Unfortunately, codesign for Windows is prohibitively expensive for me.

I can't tell if this is an issue with Bosca Ceoil or GDSiON

The file that has been flagged for you is a GDSiON DLL. But Godot itself is also sometimes falsely identified as a virus in a similar way. If you trust that the file on your PC is legit, you can help by telling your antivirus software that that was a false positive match. But of course always practice caution and if you're not sure whether the file is malicious, it's best to avoid using the app.

If it helps, you can also use Bosca Ceoil Blue through Steam:
https://store.steampowered.com/app/3570850/

PS. I also see that you're using the 32-bit version for some reason. Not sure if it's more or less prone to these false detections, but unless you're on some very old hardware and OS, it's better to use the 64-bit version instead.

[YuriSizov]

I would assume these are false positives due to the fact that it is fully open source

Oh, and I just want to make this clear in general.

Just because the project is open source doesn't mean that the compiled executables that are provided are made from the same sources. You have to trust the person that it is so, but there is absolutely no way to trace or verify that I've built those DLLs from the same sources that you see. And the same is true for any other OSS or source-available project.

Just please be aware of that.

[Elip100]

I would assume these are false positives due to the fact that it is fully open source

Oh, and I just want to make this clear in general.

Just because the project is open source doesn't mean that the compiled executables that are provided are made from the same sources. You have to trust the person that it is so, but there is absolutely no way to trace or verify that I've built those DLLs from the same sources that you see. And the same is true for any other OSS or source-available project.

Just please be aware of that.

Yes I am aware. I just know that this project specifically is a well known and well trusted program used by a lot of people. I probably should have worded that better.