New version was detected as trojan on Windows

[minngu]

I tried previous versions and they worked perfectly, but today I updated to the newest version, and got this warning, please check and fix. Thank you so much!

[allenk]

Thanks for flagging this — and don't worry, it's a false positive, not actual malware.

A few things that confirm it:

• The binary is built entirely by GitHub Actions, from this repo's public MIT-licensed source, in a clean throwaway CI runner. The full build log is public and auditable, and no human ever touches the file between source and release — there's simply no point where anything could be injected.
• VirusTotal agrees it's clean — only a couple of heuristic engines flag it while the major vendors don't: https://www.virustotal.com/gui/file/f1544edff72b7f20bda25b79bcc9cc6d1ba57c49e9fc5f9b28d1b645706f1731 (SHA256 f1544edff72b7f20bda25b79bcc9cc6d1ba57c49e9fc5f9b28d1b645706f1731 — you can match it against the file you downloaded).

Why the new version trips it when older ones didn't: the executable is unsigned, and v0.6.3 is a brand-new build that also embeds a small on-device ML model. Heuristic/ML-based antivirus engines are very twitchy about unsigned executables they haven't "seen" before — every fresh unsigned binary starts from zero reputation, so a new release commonly triggers a generic detection (often a generic Wacatac/AIDetect-style label) until reputation builds up. It's not tied to anything the program actually does.

What you can do right now:

• Re-download from the official Releases page and verify the SHA256 matches the scan above.
• Restore the file from quarantine and/or add an exclusion for it in Windows Security (Defender → Virus & threat protection → Allowed threats / Exclusions).
• If you'd rather not trust a binary at all, the source is open — you can build it yourself.

On our side: I'll submit false-positive reports to the engines that flagged it, and proper code signing is on the roadmap to stop this recurring. Sorry for the scare — the tool is safe to run.

[minngu]

I re-downloaded the file in the Releases page, and the warning disappeared. Thank you so much.
I tested multiple clips and found that some clips with fixed camera (no camera movement), the small Veo logo was not removed.

Water_flows._candle_flame_flickers_202606150652.mp4

[allenk]

Hi @minngu,

I've actually confirmed this issue. The main reason is a parameter handling problem. This issue can be avoided using the --mark veo option. In automatic mode, using explicit parameters will prevent the problem. I will address this issue in the next major version.

issue_23_1_720p_processed.mp4