Virus alert in v1.32.01

[Helix751]

FYI v1.32.01 throws a serious threat error in BitDefender (latest build). It warns about a trojan, quarantines it and prevents execution.

This doesn't happen with v1.31.x or former versions.

[Saga Musix]

https://www.virustotal.com/gui/file/b362bc3a65b78d5a0127b31607e2385d8303bafd79f12bd2b14da452a3d5d8f6

All clean, including BitDefender. So there's nothing we as OpenMPT developers can do about it (I can't just go there and say "one of my users got a warning from your software, but I don't know for which file or which signature name"). You will have to report this to BitDefender as a false positive yourself, I'm afraid.

[Helix751]

Thanks for replying anyway.

Whatever the cause of the false positive issue was, it got fixed in the 1.32.02 update.

[Saga Musix]

Good to hear that it's gone with the latest version. Malware detection is a completely intransparent process that involves tons of heuristics. To be honest it's outrageous that the difference in having a code-signing certificate attached to an executable or not changes a program from supposedly being some random nondescript trojan to being 100% clean with many virus scanners. And even when we do sign our executables, there's still random generic detections going off every now and then. The whole anti-malware industry is a giant shitshow to be honest, and as mentioned in previous threads about the same topic we as OpenMPT developers simply do not have the time and resources to constantly fight against these mis-detections (I'm sure you would rather prefer me spending an hour on improving OpenMPT rather than spending an hour sending emails to random companies after every release and then hoping something about their detection heuristics changes).
This is where you, the community, can help us, by reporting these false positives to your antivirus vendor. I hope it's obvious to you that I would never put my codesigning certificate, which is bound to my name, on an application containing malware. If you download a signed exectuable from openmpt.org, you can be confident it's safe and any malware detection is a false positive.