Windows installer marked as containing a trojan by multiple antivirues

[gotoarchi]

Virustotal is marking the windows installer of Radiance as containing a trojan:
https://www.virustotal.com/gui/file/e389fcbfe5ed838782461a53f6ef0b8c7a98ea540e7186f68232de52509f69ed/detection

I personally think its unlikely and should be clear, but an antivirus says that after decompression there are 2 files with malware: https://opentip.kaspersky.com/E389FCBFE5ED838782461A53F6EF0B8C7A98EA540E7186F68232DE52509F69ED/results

[Gregungory]

OK, but which files are being flagged? Do I need to pay for premium access to find out the "threat" we are making? That seems ridiculous. We are in the business of writing and publishing freeware. We don't make money on our efforts!

[gotoarchi]

I totally agree. I also do not see the exact files - i can try to investigate further. When i also deploy small applications using NSIS i have faced similar issues, specially when the files are recent or the installer is unsigned.

[gotoarchi]

Hi! I checked the VirusTotal Relations → Bundled files view for the Windows installer, and it helped clarify what’s going on.

VirusTotal extracts and scans all bundled files individually. What it shows is that many of the small executables in bin/ get 1–4 detections out of ~70, but there isn’t a single file that’s strongly or consistently flagged. Most of the runtime DLLs (Qt, MSVC, etc.) are completely clean.

This looks like a classic false-positive pattern caused by:

• an NSIS installer
• lots of small command-line tools
• unsigned / low-prevalence binaries

VirusTotal then rolls those small, generic detections back up to the installer, which explains the high overall score — even though no individual file looks genuinely malicious.

I didn’t see any red flags like:

• a single “bad” payload
• consistent malware family names
• suspicious network activity

So this doesn’t look like an actual trojan, just AV heuristics being over-aggressive. Code signing (even basic signing) would probably reduce these warnings a lot over time, but from a user perspective this looks safe.

I just wanted to share what I found in case it helps explain the reports.

[Gregungory]

Thanks for looking into this and summarizing your findings. I don't know what "signing" really is or how to add that to our package creation, but it can't be that difficult. We'll look into it.

[StephenCzarnecki]

Hi Greg

We had to deal with something similar ~6 months ago for some of our installers. Some people reported they were getting flagged and I spent a while going back and forth with the lab's security people to try to figure out what is going on. The short answer was for that specific case it seems to have been some false positives from an Intel FORTRAN math library that eventually dropped off as the various companies updated their definitions.

But here are a few things I remember that may or may not be useful in an order that also may or may not be useful:

1. The positives are not static. When I was investigating the reports from our users the counts and results would change somewhat rapidly. Looking back through my emails it seems like the initial report from the user was on or around 4/15 and had 12 engines reporting any positive on VirusTotal. On 4/18 that number went down to 7 and on 4/24 it went down to 4 but on 4/28 it went back up to 5. That's just a count of the engines returning at least one positive not a list of all positive reports.

2. I used both VirusTotal and https://hybrid-analysis.com/ to try to narrow things down. As you note it is not necessarily easy to figure out which files in the installer are causing which positive from the reports. So instead I ran each file in the installer through the scanners individually and then tried to figure out which files had similar-sounding positives across multiple engines.

   I think you can make a free account with VirusTotal to do bulk uploads and get a bit more access but there is a minor vetting process and there is still some stuff they keep behind a paywall.

3. We include a subset of radiance files in our installers and I ran both the ones we include and the binaries that come with the official Radiance install through both VirusTotal and hybrid-analysis.

   I suspect you only care about the files from the official installer so here are the VirusTotal reports from the following files from what I have recorded as the Radiance 6.0a (2025-04-27) installer from https://github.com/LBNL-ETA/Radiance/releases/download/bf8b9c22/Radiance_bf8b9c22_Windows.exe:

Filename	# Positive Engines	Link
cnt.exe	1	https://www.virustotal.com/gui/file/aa0896d568d93205153bb2ad3a992b1cc296d06b64aeca805749722f719b8eab?nocache=1
genBSDF.exe	2	https://www.virustotal.com/gui/file/88c77fc630bb21e19bdc292af17d27492735faa37d9e43f37933f9090e2ba073?nocache=1
getinfo.exe	1	https://www.virustotal.com/gui/file/3f0893b2a8f44b8ad876c10298d4f8335efb3e2778dd0319bdab4ee409b73efe?nocache=1
rad2mfg.exe	1	https://www.virustotal.com/gui/file/1973e090e7ec7aef3e0374f9d46445c21c2acf0def77a5d6783cf86c99952f1f?nocache=1
rfluxmtx.exe	2	https://www.virustotal.com/gui/file/eee0f66a595dc5e213b969602084a309f8e26cb37bb83058fdc5346e52267e4c?nocache=1
rmtxop.exe	2	https://www.virustotal.com/gui/file/5fc136f5f47442496a1956d2c3969f93dbd31db4103f3bffe7bbbb9de6bc8239?nocache=1
xform.exe	0	https://www.virustotal.com/gui/file/020a2e27bcf87c9acd2906741de4d768babdb8460eb4eada1761b1b75da2787c?nocache=1

However you should note that on all of those the "Last Analysis Date" is from 6 months ago. So if you were to click the "Reanalyze" button I would not at all be surprised if the counts and names of positives change.

4. To cut this already long story short, in the case I am remembering the problem turned out to be an optimization down in one of Intel's Fortran math libraries our software uses. It had some checks about the CPU architecture that some antivirus companies found offensive for somewhere between 3 and 4 weeks and now seem to be ok with again.

   Or I should say that was as best I was able to figure out. I made an exe that was empty except for one call to the offending library and it triggered the same positives. Which is not definitive proof but seemed to satisfy others involved in the discussion.

5. There is a spreadsheet with a bunch of information about the various positives on various files from when I was investigating. I'm not sure it has much Radiance-specific stuff aside from what I mentioned above but if you think it might be helpful just let me know.

It's not a great problem to try to figure out I know. And I'm not sure to what degree my delving into it for a few weeks 6 months ago might help. But if I can do anything more to help let me know.

[Gregungory]

Thanks, Stephen for digging up your earlier results. This is informative. I can't really imagine why this set of binaries is being flagged in the 6 months-old release. There seems to be no pattern. Most are small C utilities or converters. The genBSDF.exe is probably most surprising, since it is a compiled Perl script. If anything would pass muster, I would think that would, or all the compiled Perl scripts would trigger the virus scanner.

I don't see a commonality between these executables, and we don't link to any FORTRAN libraries on any of the platforms we support, so that can't be the problem. Most of them call popen() or system() or similar, spawning one or more child processes, but many other unflagged tools do that as well, and the cnt.exe tool does not.

Cheers,
-Greg

[StephenCzarnecki]

Yes, ultimately none of the positives from any of the Radiance files ended up being what the particular user's antivirus was complaining about so we didn't investigate any further.

Actually looking through my notes a bit more it seems it was the reports from hybrid-anaylsis that ended up being the most useful in the end. They had repeated mentions of "Found VM detection artifact "CPUID trick" in "sample.bin"" which is what eventually lead me to the FORTRAN library with the math optimization. Essentially it was doing something to check what sort of instruction sets the CPU supported (maybe AVX2? not really sure) for selecting optimized math routines. And the antivirus engines took that as attempting to see if it was running in a VM which is apparently a red flag.

[StephenCzarnecki]

Oh your mention of popen and system triggered another memory. Not about the installers for WINDOW and THERM but for a different issue involving building python scripts into binaries so they can be run on Windows without the users having the install python. We use (or at least used to use) something called pyinstaller to do that which has generated a few similar issues with users and antivirus. This was longer ago though so it took me a little while to recall and the details are a bit fuzzier.

There are a couple issues which may be relevant. First you can tell from the tone of their comments here https://github.com/pyinstaller/pyinstaller/blob/develop/.github/ISSUE_TEMPLATE/antivirus.md their experience dealing with similar issues

Second I recall there being a period of time where the some of the antivirus were flagging one of those exes because it was shelling out to try to manage multiple simultaneous runs of something, I think EnergyPlus. In any from what I remember it was resolved by finding a magic combination of pyinstaller version and python version to make the exe and then hasn't come up again for what looks like maybe 8 years now?

[Gregungory]

Wow, you really dug into it! I can't really imagine where any of our code would be checking the CPU instruction set, and it's definitely not common between the flagged tools, so I expect it's just random bytes it doesn't like to see together in an executable. The more executables you have, the bigger your chances of N detections.

As I said, only one of several packaged Perl (not Python) scripts was on the list. And regarding shelling out, the cnt.exe tool is very simple and doesn't do any system stuff aside from i/o.

Do you think @gotoarchi 's suggestion of signing our installer would help? Do you sign yours?

[StephenCzarnecki]

Yeah there were a few times in the past I looked into this sort of thing a bit. But it was short periods of time with very long gaps so I'm pretty far from confident on anything I am saying. I am just trying to put whatever I can remember that may be relevant down in the hopes that maybe something leads to something. I'm not expecting your binaries have the same issues but who knows?

@RDmitchell signs the installers we provide on https://windows.lbl.gov/software-tools. I've done a little with github actions like running tests and making wheels for us for python builds but haven't tried signing anything with it. Seems like there is at least one github action that already exists involving code signing but I have never used it and know nothing about it: https://github.com/marketplace/actions/code-sign-action

[StephenCzarnecki]

As to the degree signing helps I am under the impression it does but I don't know for sure. And from the VirusTotal readme "Note that this is not guaranteed to fix AV false positives but it should make them less common. Feedback wanted on to what extent this helps from people who've tried it." so it seems they are not sure how much it helps either.

One thing I do recall about signing is when you use a new cert Windows may give users one of these

for a little while until enough people have used it so that the servers recognize it. I don't remember the exact details but there is some sort of "reputation score" that Microsoft's servers use. In any case I think the last time we had to switch certs because it expired there was about a week of people saying they were getting the "Window protected your PC" message and then it went away.

[Gregungory]

Amazing. Blue screens are everyone's favorite window color. Glad they have this whole system so cleverly worked out to support us (sarcasm emoji).

Thanks for the caution. I guess we'll have to discuss the pros & cons. Not sure why this came up now and not earlier, since we've been distributing Radiance in a Windows package for a decade or more, and no one has ever come to us with this issue...

[StephenCzarnecki]

Again a vague memory but I think there are some certs (EV maybe?) that don't have that blue screen issue at the start. But they cost more and take longer so by the time we figured it out the problem had resolved itself and we didn't investigate further. I'm not sure when our current cert expires so I may have to revisit this again sooner than I'd like as well...