Avira trojan warning

[Simn]

Email I received:

Hey folks of Haxe,
i just downloaded the latest haxe windows installer but suddenly avira told me, there would be a virus in it. Crypt.Xpack.81397 to be correct.
I then went to the irc and asked some beings there and they gave me a link to older builds to check them and on every installer i picked avira said the same virus would be on.

But the binaries seems to be fine for antvir.
Probably its an antivir issue, but neverthenless people may turn off if they encounter the same issue.

bye
chris

[andyli]

I've just submitted the 3.1.3 Windows installer to https://analysis.avira.com/en/submit

I wonder if we could sign the installer in some way as this antivirus issue comes up from time to time...

[waneck]

Last time I've contacted avira about these problems, they asked me to provide a screenshot from the user when it happened. It's pretty annoying.

[autonomnom]

here you go

[Simn]

Any news on this?

[andyli]

I haven't got any follow up from Avira.

According to VirusTotal, the haxe windows installer is not flagged as virus by Avira. But there are 3 other antivirus softwares do.

[ncannasse]

I think one possible cause for this is the way we build haxelib.exe, since we append the neko bytecode at the end of the executable it creates a binary that while perfectly correct might have its PE header not conformant to its actual size.

We could maybe try for the next release to ship a haxelib binary built with hxcpp

[Simn]

I don't feel brave enough to try that for 3.2, but we should look into this problem afterwards if it still exists.

[waneck]

I think there's a problem with haxelib selfupdate and running haxelib through haxe --run - that's why it's using the neko interface atm.

[ncannasse]

If you wish me to get a certificate so we can sign our installer, tell me.

[Simn]

I'm too stingy to suggest spending money on that. Let's just get big enough to the point where they can no longer ignore us. :)

[ncannasse]

@Simn sadly I don't think it will work

[ncannasse]

Even the bigger companies happen to be reported as false positive, hence the code signing (and it's not very expensive)