If you want to assess for yourself whether this is likely to be a false
positive you could upload the offending file to VirusTotal https://www.virustotal.com/gui/home/upload and see what other AV programs
make of it. I couldn't get hold of the 12269 build, but I downloaded the
current build (12279) and uploaded rexxhide to totalvirus. 6 out of 65 AV
products reported trojans in it (each different trojans) but not MS which
gave it the all clear and none of them reported Zpevdo.B. So, updating to
the latest release might give you a route past the Windows Security block.
This is indeed a reoccurring problem. I think it would help if we managed to get 5.0.0 officially released & checked/signed so people are not scared off trying to use it. As it is now 5.0.0 is a significant improvement compared to 4.2/4.3 and I have not heard about any showstoppers, or are there really some left?
Am 04.09.2021 um 19:37 schrieb Jon Wolfers <sahananda@users.sourceforge.net <a="" href="mailto:sahananda@users.sourceforge.net">sahananda@users.sourceforge.net>:</sahananda@users.sourceforge.net>
If you want to assess for yourself whether this is likely to be a false
positive you could upload the offending file to VirusTotal https://www.virustotal.com/gui/home/upload <https://www.virustotal.com/gui/home/upload> and see what other AV programs
make of it. I couldn't get hold of the 12269 build, but I downloaded the
current build (12279) and uploaded rexxhide to totalvirus. 6 out of 65 AV
products reported trojans in it (each different trojans) but not MS which
gave it the all clear and none of them reported Zpevdo.B. So, updating to
the latest release might give you a route past the Windows Security block.
This is indeed a reoccurring problem. I think it would help if we managed to get 5.0.0 officially released & checked/signed so people are not scared off trying to use it. As it is now 5.0.0 is a significant improvement compared to 4.2/4.3 and I have not heard about any showstoppers, or are there really some left?
If you want to assess for yourself whether this is likely to be a false
positive you could upload the offending file to VirusTotal https://www.virustotal.com/gui/home/upload and see what other AV programs
make of it. I couldn't get hold of the 12269 build, but I downloaded the
current build (12279) and uploaded rexxhide to totalvirus. 6 out of 65 AV
products reported trojans in it (each different trojans) but not MS which
gave it the all clear and none of them reported Zpevdo.B. So, updating to
the latest release might give you a route past the Windows Security block.
Thank you Jon. I uploaded rexxhide.exe to the site you suggested and also got 6 AV saying its bad. I will open a bug report. I think its false but its scaring a lot of users of my program.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Last edit: Paul Higgins 2021-09-04
See attachment
Rexx version is:REXX-ooRexx_5.0.0(MT)_32-bit 5.0.0
12:29:04.526000 Open Object Rexx Version 5.0.0 r12269
12:29:04.530000 Build date: Jun 10 2021
12:29:04.536000 Addressing mode: 32
Hi Paul,
I think the best way to alert the developers to this is to open a bug
report here https://sourceforge.net/p/oorexx/bugs
We have had problems with false positives before here
https://sourceforge.net/p/oorexx/bugs/1713/ and here
https://sourceforge.net/p/oorexx/bugs/1760/
If you want to assess for yourself whether this is likely to be a false
positive you could upload the offending file to VirusTotal
https://www.virustotal.com/gui/home/upload and see what other AV programs
make of it. I couldn't get hold of the 12269 build, but I downloaded the
current build (12279) and uploaded rexxhide to totalvirus. 6 out of 65 AV
products reported trojans in it (each different trojans) but not MS which
gave it the all clear and none of them reported Zpevdo.B. So, updating to
the latest release might give you a route past the Windows Security block.
hope that helps
Jon
On Sat, 4 Sept 2021 at 09:27, Paul Higgins phiggins-99@users.sourceforge.net wrote:
https://docs.microsoft.com/en-us/windows/win32/appxpkg/how-to-sign-a-package-using-signtool https://docs.microsoft.com/en-us/windows/win32/appxpkg/how-to-sign-a-package-using-signtool
Hälsningar/Regards/Grüsse,
P.O. Jonsson
oorexx@jonases.se
This is indeed a reoccurring problem. I think it would help if we managed to get 5.0.0 officially released & checked/signed so people are not scared off trying to use it. As it is now 5.0.0 is a significant improvement compared to 4.2/4.3 and I have not heard about any showstoppers, or are there really some left?
Hälsningar/Regards/Grüsse,
P.O. Jonsson
oorexx@jonases.se
Thank you Jon. I uploaded rexxhide.exe to the site you suggested and also got 6 AV saying its bad. I will open a bug report. I think its false but its scaring a lot of users of my program.
I found this problem seems to be caused by a change in R11367 https://sourceforge.net/p/oorexx/feature-requests/712/
If I replace the rexxhide.exe in r12269 with the one from R11912 the problem goes away.