Trojan.Win64.Injector detected by HarfangLab antivirus in MSI installer

[MatthieuDartiailh]

After downloading the MSI installer from https://gitbutler.com/downloads for version 0.19.3, my antivirus automatically quarantine the file complaining about a Trojan.Win64.Injector.

The antivirus in question is HarfangLab 5.3.33

[Byron]

Thanks a lot for reporting!

These are always (from our experience) false positives and @krlvi can fix it by uploading information (about every release) to their servers. Let's hope this fixes it.

[krlvi]

Thanks for flagging. Im gonna reach out to HarfangLab to see if we can pin-point what triggers it. In the past the use of Tauri was the source

[PetrAltman]

Microsoft Defender reports Trojan:Win32/Wacatac.H!ml in gitbutler-git-setsid.exe.

Here is result from virustotal: https://www.virustotal.com/gui/file/fcb57ae96e6c656c982a787de2c65c96811cea32fd616f168cf0879565c9396b

[krlvi]

This is something we have struggled with for some time. It appears that AV providers trigger false positives due to the use of named pipes.

To mitigate this issue we had a long standing practice of reporting the false positive for every release to a big number of the vendors - linking a sample plus the source code to the setsid binary.

However a better solution was removing the setsid completely #12471
From the next release onwards, at least that binary will just not exist anymore
cc @slarse

[slarse]

@krlvi The gitbutler-git-setsid.exe binary on Windows never used a named pipe. In fact, it never did anything and was probably bundled by accident. You're probably thinking of gitbutler-git-askpass.exe, which is still there and still has the named pipe.

If you were to execute gitbutler-git-setsid.exe, it would just panic. This is what the implementation looked like:

gitbutler/crates/gitbutler-git/src/bin/setsid/windows.rs

Lines 1 to 3 in 485bd78

	pub fn main() {
	panic!("This binary is only meant to be run on Unix-like systems. It exists on Windows only because Cargo cannot switch off bins based on target platform.");
	}

Perhaps the fact that it is hard-wired to crash is causing false positives on it.

I'm hoping to get rid of the gitbutler-git-askpass[.exe] binary, too. That should further decrease false positives. But I don't think I can get rid of the named pipes, they kind of need to be there for IPC. Perhaps there's a better mechanism on Windows that doesn't trigger AV as much.

[slarse]

Closing this as the gitbutler-git-setsid.exe binary no longer exists, so this exact problem should be dealt with.