Resolve spurious virus detection in installer

Help
1

Steps to reproduce

  • Download the Windows Obsidian installer (tested on 1.13.4)
  • Upload the installer to the VirusTotal website’s file scan

Did you follow the troubleshooting guide? [Y/N]

Yes

Expected result

The virus scan reports zero hits

Actual result

The scanner for Kingsoft reports a hit for “Win32.Troj.injector.v”

Environment

n/a

Additional information

I’ve been using Obsidian personally for a while; however, IT at my workplace won’t allow us to install it on work machines so long as it registers any hits on a virus scanner.
I fully expect this is a false positive, but a clean scan would let me install the app in more places.

2

These are false positives and I am not sure if there’s anything we can do.

3

Thanks for looking, WhiteNoise!

I know false positives on virus checkers are a nightmare to track down, and (looking in to Kingsoft) it seems like reaching out to that organization isn’t likely to get you anywhere, which is a shame. That leaves bisecting through builds to see what’s triggering changes.

I did a few extra scans of recent releases to add some info, and found:

  • 1.9.12: clean
  • 1.11.4: clean
  • 1.11.5: clean
  • 1.11.7: Flagged twice for HEUR_NAMETRICK.D
  • 1.12.4: Flagged once for HEUR_NAMETRICK.D
  • 1.13.4: Win32.Troj.injector.v and HEUR_NAMETRICK.D. (It looks like TrendMicro flagged a few new things in the last day or so. They’re probably easier to contact than Kingsoft…)

I’m not sure if this helps narrow down the search space, but it seems like there are two windows of interest:

  • 1.11.5 to 1.11.7: HEUR_NAMETRICK.D false positive introduced
  • 1.12.4 to 1.13.4: Win32.Troj.injector.v false positive introduced