Virus alerts

i checked the windows versions from 1.20 to the latest with virustotal.com and EVERY version has 1 , some 3 virus alerts!

Cannot reproduce. Both the zip and exe for 1.27.10 Windows x86-64 are not flagged by any vendor on VirusTotal:

What files are you looking at?

1 Like

i downloaded the 1.27.10.exe and then uploaded to virustotal

strange, whe i enter the URL to make virustotal download the file directly, as you did, there is no alert. So, you think, the virus is from my system? No, because other exe which are downloaded since long time have no alert, and also the alert of 1.27.3 is different: VirusTotal

Regardless of what you are looking at, experience says it’s snakeoil vendors creating pointless panic (or a false positive in non-technical terms). I’d recommend to get your programs from a trusted source and get rid of the snakeoil (if you can).

3 Likes

You’re looking at the Windows installer, which apparently triggers some false positives, probably based on heuristics :person_shrugging:

I do know that on Windows systems directly, these downloads can trigger a Defender-warning because the used link to download the executable/installer is used seldom. I guess the online scanners do some similar magic… I’m not sure about this installer, but e.g. lacking validated ‘Publisher’ information can easily trigger these kind of flags as well.

There’s a reason why the flags are so utterly vague:)

The false positives have been a problem for the Windows installer since the very beginning (see https://github.com/Bill-Stewart/SyncthingWindowsSetup/issues?q=virus). The fact that currently it’s only a very small number of scanners that detect it as a virus can be considered success.

2 Likes

I just added a new ‘antimalware-falspositive’ tag to the issues list:

https://github.com/Bill-Stewart/SyncthingWindowsSetup/issues?q=is%3Aissue+label%3Aantimalware-falsepositive

No anti-malware scanner is 100% free of false-positives, regardless of their claims to the contrary.

2 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.