New version - Kaspersky reports trojan virus

[aljazvidmar]

Version 5.11.2.20 exe when i try to install it on Windows it reports trojan virus.
Automatic update from version 19 also fails with same problem.

[psieg]

Ouch, that's bad. It's a small helper that allows running as administrator without the UAC prompt - that enables the automatic update.
It only runs executables signed by a key only I posess, so it should be safe.

What's curious is that I buillt that binary only two days ago. That would be very fast for someone to find a way to abuse it, if one exists.
The previous version of that binary is not detected: https://www.virustotal.com/gui/file/14843630b2e4dc34e1db77f0d5bce9f18d35674d9d1dd229b8b39ba46975ca8d/detection

[Dukism]

I can confirm there is a Trojan. Kasperky detected it but I decided to install it anymay.
My computer started to have a problems, Kasperky Shutdown, I was not able tu open any website on chrome and can't shudown my computer. =/
After a hard restart thanks to kaspersky I was able to recover my computer but there is definitely something wrong with the software.

[psieg]

Sorry to hear. I have stopped the automatic update of clients not updated yet. Will investigate more when I can.

[psieg]

I see two options here:

1. Supply chain attack
   My build VM may be infected and used to infect the programs it builds.
   I'm checking the VM for signs of infection and will run a virus scan.
   However the UpdateElevate.exe has exactly the same size when I compile it locally - if some bad code was added, I would assume it to be larger. Also I didn't observe abnormal behavior on my computer after installing the latest version.
2. False-positive
   Packing a statically-linked binary that includes openssl (encryption routines) into the installer that sets up a scheduled task may be considered suspicious by behavioral analysis engines. The program also does some access modifications that may look suspicious without context.

To test, I rebuilt 5.11.2.20 on my PC.
On virustotal, that version too is detected by a few engines: https://www.virustotal.com/gui/file/9b6652aaef3eb375cdd28f18f7ce24e1c392ad1c6a46ec185e9d0f175cd17ee5/detection
It's unlikely both the VM and my PC are compromised by something that's capable of infecting the Software built on the machine.

Thus I'm leaning towards 2) here. The new build is on the releases page, could you please check if it triggers your AV?

Did anyone else observe malicious behavior after running the installer?

[zomfg]

Builtin Windows (10) Security reports the installer as Trojan:Win32/Detplock (like on virustotal)

[psieg]

I created a new build where the UpdateElevate tool is dynamically linked instead of static. The openssl library itself is ok an the tool is also considered ok too. Will observe how virustotal develops over time...
https://www.virustotal.com/gui/file/cc90cc0d1efa27f769e7f0206f1daac9b4c02fa022f23f19ae800a23353414a3/detection

[aljazvidmar]

The new build works fine - no virus detected.
Very happy to see new mood lamp modes - please add custom setting (for example based on image as source)

[zomfg]

@aljazvidmar please make a separate feature request detailing your moodlamp ideas in case other people would like to chime in