bug: Windows defender flags `eza` as a trojan (false positive) about eza

[PThorpe92]

Thank you for reporting this 👍

Looking into this myself right now, and I assigned our resident Windows guy @daviessm

I know windows defender will pretty much alert to any exe that isn't digitally signed with a cert authority. We will have to figure that out. Web requests dont make sense to me though at all. Looking into this...

[egelja]

Interestingly, according to VT, eza seems to be making web requests too.

[cafkafk]

The SHA-256 hash of the file is 480bceb36fe41c436d4ae3816333e0dcb2c9afbc5da56a8fb78315faaf5dc24f. VirusTotal analysis can be found here.

This is the same as is generated through cross

480bceb36fe41c436d4ae3816333e0dcb2c9afbc5da56a8fb78315faaf5dc24f  target/x86_64-pc-windows-gnu/release/eza.exe

This is very odd... could it just be a hash collision? I'm not sure how VT works.

[egelja]

This is very odd... could it just be a hash collision? I'm not sure how VT works.

I doubt it — the file wasn't uploaded until today.

There are some more hashes in the details tab on VT if you want to check.

[cafkafk]

The cross compilation is done via https://github.com/cross-rs/cross, I tested cross build --target x86_64-pc-windows-gnu --release on another project of mine and it didn't cause this issue, so it's not that.

[cafkafk]

This should just be a false positive, I've submitted a request to "Microsoft Security Intelligence" to have the binary reassessed, hopefully it won't take too long.

[cafkafk]

Microsoft got back to us:

At this time, the submitted files do not meet our criteria for malware or potentially unwanted applications. The detection has been removed. Please follow the steps below to clear cached detections and obtain the latest malware definitions.

     1. Open command prompt as administrator and change directory to c:\Program Files\Windows Defender 
     2. Run “MpCmdRun.exe -removedefinitions -dynamicsignatures”
     3. Run "MpCmdRun.exe -SignatureUpdate"

Alternatively, the latest definition is available for download here: https://docs.microsoft.com/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus

I couldn't find a way to contact Bkav Pro, so I'm closing this as solved for now.