Trojan virus detected on 1.7.1 exe

[D4VID-B]

Went to download the EDScout.exe and Windows defender flagged it as having a virus on it. I saw that there was a similar Issue, but the virus they reported was different to what Defender found on my machine:

Let's hope this is also a false positive.
Also, if possible add a hash checksum to the important files so we can verify them.
Thank you

[joncage]

Submitted to MS for review - thanks for reporting: https://www.microsoft.com/en-us/wdsi/submission/b12018fa-6c58-4b06-8cd2-ebaa8c746e2d

Good idea r.e. the checksums.

[Gopher-nz]

Yup got same problem - I did have a few issues but I think it is working - sort of. Well v1.7 works I think.

[joncage]

From Microsoft...

We have reviewed the files and we have added detection for them to the next definition update. The latest definitions information is available here: https://www.microsoft.com/en-us/wdsi/definitions.

Thank you for contacting Microsoft.

[joncage]

Try updating your virus Defs and give it another shot. I think it has less problems with the installed version too if that helps..

[D4VID-B]

Tried again, with (what I think are) the latest Defs. Now getting this:

Any ideas why this is happening to your files? I've been setting up a number of tools for Elite and haven't had this happen anywhere.
Also (and this is somewhat off-topic) what does the Setup-EDScout.exe do? Maybe I can try using it instead.

[joncage]

My guess (and frankly I don't know) is that because I've written this in Python, used a flask web server and packaged it up with PyInstaller, that Microsoft's tools look at and say "Well this looks suspicious; Written in Python and it extracts python code and then runs it? I'd better flag this". It's becoming pretty frustrating because I have to do this every time I release another version (and apparently now multiple times).

The Setup-EDScout.exe is an installer that installs the executable to program files. I read somewhere that using an installer can help as viruses tend not to bother with installers so that may help and I may well ditch the portable EDScout.exe I'd been releasing in parallel to cut down on my work load.

I know EDDiscovery is written in C# and as that's Microsoft's language, maybe they're less suspicious of it. I think this is all part of their cunning plan to get more people writing C# and to encourage more poor developers to shell out hard earned cash to add certificates to sign the software releases.

[joncage]

Submitted again: https://www.microsoft.com/en-us/wdsi/submission/6dc85a2b-6a84-44c8-9edd-59f2a6cef07e

[Rhaedas]

A quick and not thorough Google suggests that this is a common thing with using PyInstaller for a few reasons. There's a number of problems and "solutions" on StackOverflow, not sure if any would apply here. But I did have a thought - could you go ahead and submit a new version's exe to MS as being okay as a step in releasing it? Why wait for user reports if it's going to be a thing, just get it into their system to look at and approve.

[D4VID-B]

Yeah, I can imagine this is annoying. Which is why I hate to say this, but:

This was on the Setup exe I tried downloading just now.

Also, I appreciate you sharing the submission links, but I can't access them. Microsoft just shows this when I click the link: "You are not authorized to view details for the requested submission id (6dc85a2b-6a84-44c8-9edd-59f2a6cef07e)."
I'm logged in too - don't know if that affects things. Maybe it's a defense precaution.

[D4VID-B]

Also, regarding this being in Python, maybe try contacting the devs of ED Market Connector? Their Github shows that it's 100% Python and I didn't get any antivirus hits when installing their tool

[joncage]

Also, I appreciate you sharing the submission links, but I can't access them.

To be honest, I do that mostly for my own reference to make it easy to double-check the status.

Double-checking with EDMC is a good call. Looks like they use Py2Exe rather than PyInstaller and TKinter instead of a web UI so maybe it's that or maybe they have a way of signing releases I couldn't see from a quick source-skim.

Just as annoyingly, for some reason I never see this virus alerts when I download the same .exe's from github.

Submitted for the installer here too: https://www.microsoft.com/en-us/wdsi/submission/7d6d6cb3-7706-4405-ae9b-d6e64858f6fd

MS are this time refusing to unblock the EDScout.exe so I've raised a dispute with them. More fun and games!

[joncage]

Scanning the same .exe's I've uploaded to github from my machine I get no matches:

...which just makes this all the stranger. I don't understand why defender takes such an issue with this but I'll keep on battling!

[joncage]

A quick and not thorough Google suggests that this is a common thing with using PyInstaller for a few reasons. There's a number of problems and "solutions" on StackOverflow, not sure if any would apply here. But I did have a thought - could you go ahead and submit a new version's exe to MS as being okay as a step in releasing it? Why wait for user reports if it's going to be a thing, just get it into their system to look at and approve.

I'd had the same thought (proactive submission) but you're required to specify what detection was found and as my machine never marks them as bad in the first place that's impossible for me.

[D4VID-B]

Maybe its something to do with you also being the author and having the source code on the computer, or something else related to you being the author.
I'll wait for a bit, or until MC releases another Def or something and try again. Might try to mess around with it's settings too - maybe it's possible to make it less trigger-happy...

[joncage]

Maybe its something to do with you also being the author and having the source code on the computer, or something else related to you being the author.

Yeah, possibly.

If I find some time I'll have a bit more of a dig into EDMC and how they package things. I note that they produce a .msi rather than a innosetup-generated .exe installer which may also be another avenue to solve this. Very difficult to debug multi-faceted issues like this when all you have is the Microsoft black box telling you that they sort of (and inconsistently) don't like what you're doing...

[joncage]

Well at least for the setup file they've confirmed:

We have removed the detection. Please follow the steps below to clear cached detection and obtain the latest malware definitions.

1. Open command prompt as administrator and change directory to c:\Program Files\Windows Defender
2. Run “MpCmdRun.exe -removedefinitions -dynamicsignatures”
3. Run "MpCmdRun.exe -SignatureUpdate"

Alternatively, the latest definition is available for download here: https://www.microsoft.com/en-us/wdsi/definitions

[D4VID-B]

Ok. A this point I'm starting to get somewhat fed up with Windows Defender. I ran the command prompt commands and everything updated, but it's still flagging Setup as having that Trojan. Any estimate on when (if at all) you can make the checksums available for these files? That way I can at least make sure my files match yours when I override Defender to install it.
Take your time if you have too, I'm not planning to go far from the Bubble quite yet :)

[joncage]

Just for you (I'll automate this later)...

[joncage]

Found an interesting tool today; Virustotal.

For EDScout.exe we get: https://www.virustotal.com/gui/file/cd63e536fe177452883eca53322bba3bb79334f3ab85a16acc6846544da2c207/detection

For the installer we get:

https://www.virustotal.com/gui/file/89572817ef584e475edf737d60e2464bf7bf8cd8563d316428e1703b63b38f21/detection

[joncage]

Longer term #114 should avoid these issues... or that's the intention at least.

[joncage]

Being paranoid, I ran defender over my entire drive and it came up empty for viruses (FYI).

[D4VID-B]

Oh yeah, I've seen that on EDDiscovery's GitHub. He includes a screenshot of this every new release.
I guess Microsoft really does have an issue with Python for some reason...
Tomorrow, I'll try again, override Defender, get the hash from the file and stick it into Virustotal. At that point, if it's still complaining, it's getting outvoted.
As far as signing goes - since it's paid I'd almost consider it a last resort if doing things similar to EDMC isn't an option.

[joncage]

Appreciate the vote of confidence and your resolve Cmdr!

o7

[D4VID-B]

The hash values matched and everything seems to be working! I used the Setup... .exe this time.
I do have one (fairly off-topic) question though: are you using the in-game HUD color matrix to do the UI color? Because in your screenshots and in DTEA's video it's the traditional Orange-Black, whereas mine is Green(ish)-Black:

I am using a custom HUD color matrix, hence the question.

[Rhaedas]

To answer the question, yes, one of the first additions to this program he put in was to see if a user had a custom HUD setup to try and match it.

[D4VID-B]

Ah, nice touch!
So since this particular issue is more-or-less resolved, should I close it? Or do you have other plans for it?

[joncage]

I have one more bit to add - Microsoft sent me an additional message I want to capture here after I disputed it.

..and yes, the colour matching is done so that the Scout matches your HUD. That was a fun one to implement! 👌🏻😊

[joncage]

Here's what Microsoft said after I raised a dispute...

Thank you for your recent inquiry about EDScout (submission reference: 6dc85a2b-6a84-44c8-9edd-59f2a6cef07e; file reference: [edscout.exe, cd63e536fe177452883eca53322bba3bb79334f3ab85a16acc6846544da2c207] ) in connection with the operation of Windows Defender.

The new security intelligence update version 1.325.681.0 contains changes necessary to resolve your question relating to EDScout.  This new security intelligence update is now available for users who subscribe to the automatic security intelligence update mechanism, as well as users who choose to manually update their security intelligence update library.

We encourage you to try this new security intelligence update and confirm your inquiry has been resolved.  If your machine has not been updated with this version of security intelligence update you can download and install the update manually following these steps:

· Go to https://www.microsoft.com/en-us/wdsi/defenderupdates
· Download the corresponding definitions (32 bit or 64 bit based on your operating system)
· Run the downloaded file to install the new definitions

We apologize for any inconvenience this may have caused. If you have any additional questions related to this inquiry, please contact us at [email protected]. Should you need to contact us in the future regarding a question unrelated to this inquiry, please visit Microsoft Security Intelligence portal https://www.microsoft.com/en-us/wdsi.

Sincerely,

Microsoft Defender Response

[joncage]

Closing this now as that should hopefully be the end of it..