Both MSI Installer and Zip of Exe Flagging Malware For Latest Stable And Dev Releases

[Huberdoggy]

I was eager to get started using this project after coming across information on it last night, and reviewing the requirements and setup steps needed on a Synology NAS. However, as the title states, VirusTotal as well as Hybrid Analysis are flagging W32 and Agent Tesla malware across files within the downloads.

I didn't see any discussions relevant to this, so wanted to start one to better determine what's going on here.

Thanks!

[gbakeman]

Hi,

Thanks for bringing this to my attention. I just threw the latest noinstaller archive up in VirusTotal here, which gives a 2/64 detection rate. They both seem to be categorized as suspicious/heuristic detections. At some point I would like to start signing the builds (see #84 ) which may help with some malware detections, but in the meantime I think the two detections can be written off as a false positive.

Let me know if I'm still missing something or haven't quite addressed the issue. Hope this client works well for you!

[Huberdoggy]

Thanks for the prompt response.

Side question, is there any advantage to using one method over the other (msi vs exe)? I'm wondering if I were to go the exe route per say, I could use a custom directory and run it as a standalone program; excluding said directory and process from Defender easier.

Or does the program write to the registry and user appdata regardless of which method I choose?

[gbakeman]

I'd say the recommended method (as the maintainer) would be to use the MSI. You'll get the usual advantages of MSI packaging and management as an end user, plus the WinNUT built-in updater relies on the MSIs for auto updates so you'd have the benefit of simplicity from that perspective. As I'm writing this now, I think both the MSI and NoInstaller/ZIPped versions use standard data paths (%LOCALAPPDATA%\NUTDotNet\WinNUT) which I don't think was the intent since the NoInstaller was supposed to keep its data with the executable. If you'd like to have that portable functionality, feel free to open an issue and I can take a look at fixing that.

It should be fairly trivial to exclude the installer's appdir (C:\Program Files (x86)\WinNUT-client). Is Windows Defender actually quarantining it?

[Huberdoggy]

I have not yet extracted the files ( or in the case of the msi, ran the installer) to test that. Just anticipating the potential for it in advance

[gbakeman]

I think other users have experienced a warning prompt from Defender stating that it's untrusted (lack of certificate/popularity) so you may get that, but otherwise I haven't heard of Defender going so far as quarantining it. I'm working towards replacing our distribution and packaging system with ClickOnce and will hopefully have a graceful transition between the MSI and that, so I'd say to go with the MSI.

[Huberdoggy]

Will do! Thanks for all the detailed info. I'm about to do it as we speak, looking forward to using this tool