USPIP.exe is reporting as infected about usbip-win

[elamast]

Have you run it through VirusTotal? Sent from MailDroid

…

-----Original Message----- From: KyungWoon Cho <[email protected]> To: cezanne/usbip-win <[email protected]> Cc: Edward Lamaster <[email protected]>, Mention <[email protected]> Sent: Sat, 04 Apr 2020 7:11 AM Subject: Re: [cezanne/usbip-win] USPIP.exe is reporting as infected (#50) @mahmoudajawad<https://github.com/mahmoudajawad> : weird.. I have checked a downloaded usbip.exe with a recent virus checker but there's no virus reported. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#50 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ABPNTBBGGT4X5MK7O4S2EZDRK4PXLANCNFSM4IDX6KVQ>.

[cezanne]

We are speaking about last published binaries, right?

@mahmoudajawad : Yes. https://github.com/cezanne/usbip-win/releases/download/v0.0.9/usbip.exe

This is virus total result for usbip.exe as @elamast suggested.

[cezuni]

@elamast : Thanks!
VirusTotal reports that all exe binaries in 0.0.5 and 0.0.3 have been infected. I'll check my windows dev box.

[cezuni]

@elamast : Executable built by VS is often incorrectly detected as virus. I had found some stackoverflow links. Is this our case?

[cezuni]

@elamast : I checked that recent release binaries(v0.0.6) are clean. As all usbip-win release binaries have been built in the same machine, my machine seems to be not infected with some viruses. As commented previously, I suspect that virus alert was caused by an invalid virus detection logic.

[cezuni]

@elmast: I'll close it. Please reopen if you want.

[mahmoudajawad]

@cezuni, the last published binaries are reported as infected with a trojan:
Trojan:Win32/Wacatac.D!ml

[cezanne]

@mahmoudajawad :

the last published binaries are reported as infected with a trojan:
Trojan:Win32/Wacatac.D!ml

Which file? Binaries in v0.0.9 are checked as no problem from the upper web site.

[mahmoudajawad]

Here's the report from Windows Defender:

It's wortth noting that Edge (chromium) refused to download the files initially as they were reported suspicious by SmartScreen. But, I ignored at forced downloaded the files. However, Windows Defender instantly removed them from my Downloads folder.

[cezanne]

@mahmoudajawad : weird.. I have checked a downloaded usbip.exe with a recent virus checker but there's no virus reported.

[mahmoudajawad]

We are speaking about last published binaries, right?

[mahmoudajawad]

No. As I mentioned, it was deleted by Windows Defender automatically without even me scanning the files manually.

[mahmoudajawad]

Hmm. This must've been some false positive. I just tried downloading the files again using Firefox this time and things went fine. It's not clear to me at all why Windows Defender decided the files were infected with some trojan first time. Thanks for your time on this, @cezanne

[Jackfritt]

Latest Release usbip-win-0.3.6-dev.zip also get reported by virustotal.
I think its a false positive. What do you think?

https://www.virustotal.com/gui/file/489daccb3ddffb1ec83ab6e0a4f56a8b13a9af34ca4f9bf445357053aad46dc2

https://www.virustotal.com/gui/file/5a57753f17bfc6436708fbaac22b1e324f178b25b505111819989eefe936d281/behavior
1 match for rule Failed Code Integrity Checks by Thomas Patzke from Sigma Integrated
1 match for rule Use Remove-Item to Delete File by frack113 from Sigma Integrated Rule

https://www.virustotal.com/gui/file/8d0fd393dc9e8aaa1722c51190ebb872089867b0c34aa6b86dfcc69af87f153a/details
A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.