2.1.5 is detected by Windows Defender as containing a trojan virus about unifi-search-tool HOT 7 OPEN

Thank you for reporting this.

I genuinely have no idea why Windows Defender is suddenly flagging this, especially with minimal changes in v2.1.5. The only changes in v2.1.5 were dependency updates to fix some moderate to high vulnerabilities (as seen here). I haven't noticed any issues on my end which makes this hard to research.

Can you give me some info on your current windows version? Right click windows icon on start menu -> System -> Windows specifications -> Copy, then paste the results here.

I will investigate, but I may ultimately come up empty.

from unifi-search-tool.

Sure, here's my desktop where I ran into this:

Edition Windows 11 Pro
Version 23H2
Installed on ‎2023-‎04-‎23
OS build 22631.3235
Experience Windows Feature Experience Pack 1000.22687.1000.0

My laptop is not flagging this but it is still on 22H2 for some reason:

Edition Windows 11 Home
Version 22H2
Installed on ‎2022-‎11-‎23
OS build 22621.3235
Serial number ###
Experience Windows Feature Experience Pack 1000.22687.1000.0

from unifi-search-tool.

Interesting, thank you.

I'm still on Windows 10, which could be why it's not flagging on my system. I'm on 22H2 as well.

I had VirusTotal analyze it and there were 3 detections false positives: https://www.virustotal.com/gui/file/913e964f9495c59088887e8ef4e945de7f04ca6857d3c1ea00567ee9b0ee2e51

I've never run into this issue before so this will not be a fun problem to solve.

from unifi-search-tool.

Can you give v2.1.6 a try? I don't believe this will fix the problem based on my changes, but, then again, I didn't expect it to be tagged as a trojan in the first place.

https://github.com/Crypto-Spartan/unifi-search-tool/releases/tag/v2.1.6

from unifi-search-tool.

Had the same issue with being flagged as a trojan, I even tried an older release. To be honest you have me worried and skeptical.

from unifi-search-tool.

Just released v2.2.0. Feel free to give that one a try. However, you don't have to use this tool if you don't want to.

I genuinely can't explain why those releases got detected as a trojan/malware. I really wish I knew, but I don't. I have no intention of hiding anything. I also included instructions in the repo for how to build it from source yourself if you don't want to be reliant on the executable that I upload with each release.

Feel free to take a look at the code. You'll notice that the only network calls are those made by reqwest to the API of a Unifi controller. The user is in complete control of where these network requests go as it is required to type in a controller URL to use the tool. The code for those network requests is here. Any other network requests made by my tool would be from one of the dependencies, and I'm not aware of any outstanding issue with any of the crates that I'm using. If you are aware of one, please let me know.

You'll also notice that I added hashes for the executable at the end of the release notes, along with a link to VirusTotal. I calculated the hashes on my own PC before I uploaded the file to Github & VirusTotal. The hashes from VirusTotal match the hashes that I calculated myself. Feel free to verify this as you wish.

I'm happy to address any specific concerns you may have, but I don't really have much I can say or do about generic concerns related to these previous false positives from Windows Defender.

from unifi-search-tool.

I appreciate you checking into it. Really useful tool. Hopefully Defender settles down with the warnings.

from unifi-search-tool.