DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 6C6E23836D16
Subject: Re: Cygwin setup reporter as malware
To: cygwin@cygwin.com
References: <AS8PR07MB714100AE9CFC6D5AAEE34179D91A9@AS8PR07MB7141.eurprd07.prod.outlook.com>
 <14e7843a-5829-2c74-313b-13d08b37243e@harkless.org>
 <6e721522-7e4a-d0d9-f928-4bc6e1b34f3f@oskog97.com>
 <65ad5397-2de1-87e1-d747-bcb1b4fc6e70@harkless.org>
Message-ID: <7b5543d1-7fe6-64c5-ad48-72ffff48cdd7@t-online.de>
Date: Fri, 9 Dec 2022 19:49:13 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101
 SeaMonkey/2.53.14
MIME-Version: 1.0
In-Reply-To: <65ad5397-2de1-87e1-d747-bcb1b4fc6e70@harkless.org>
Precedence: list
From: Christian Franke via Cygwin <cygwin@cygwin.com>
Reply-To: Christian Franke <Christian.Franke@t-online.de>
Content-Type: text/plain; charset="utf-8"; Format="flowed"
Errors-To: cygwin-bounces+archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie.com@cygwin.com>
Content-Transfer-Encoding: 8bit

Dan Harkless via Cygwin wrote:
> On 12/9/2022 3:39 AM, Oskar Skog via Cygwin wrote:
>> On 2022-12-07 23:54, Dan Harkless via Cygwin wrote:
>>
>> > No.  It's normal and common for software like Cygwin, which has the 
>> > power to be used maliciously (as opposed to, say, a Minesweeper 
>> game or > something), to have false positives on VirusTotal for a 
>> handful of > vendors.  I've never heard of SecureAge or Trapmine 
>> (hmm, maybe it > *would* flag Minesweeper...), and I'm pretty well 
>> educated in the > anti-malware space, so if it were me, I'd just 
>> ignore those false > positives and pay attention to the credible AV 
>> software results (and the > Community Score).
>>
>> You may have thought you were joking, but...
>>
>> https://www.virustotal.com/gui/file/bcff89311d792f6428468e813ac6929a346a979f907071c302f418d128eaaf41 
>>
>>
>> This is not just *a* minesweeper game, it is *the* minesweeper game
>> from Window XP.
>
> LOL!  You're right, I'd never heard about that, and was just using 
> Minesweeper as an obviously safe example program.  And whaddaya know, 
> it's SecureAge and Trapmine (oy!) that "flag" it.  I guess the lesson 
> is to always ignore SecureAge and Trapmine results on VirusTotal, and 
> the OP should suggest VirusTotal drop those two from their AV software 
> suite.
>
> Thanks for the amusing link, Oskar.

Amusing, indeed.

This was less amusing: After I released this file Dec 30, 2018, it 
scored 7/67 and then 13/70 a few hours later, including well-known AV 
vendors:
https://www.virustotal.com/gui/file/bf0416c2e214c6323fdf1af8b853f761c846760f02950453c8a5bb276c961fbe
After FP reports to several vendors, it slowly dropped down to 1-2 
detections until March 2019.

Experience since then suggests that some noise of ~2 detections from not 
well-known AV is normal.


-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple