VIRUS? Win64:Malware-gen

[Backi67]

Hi,
when I download Synctracor (2.0.3) i get an error Message from "NORTON" there ist WIN64:Malware-gen in this file.
Is this a mistake?
Yours
Stephan

[GermanCoding]

Yeah I saw this as well on VirusTotal. The funny thing is, the previous release has a binary that's almost identical but that is fine.

These are false positives and they're bound to happen from time to time unfortunately. Please report them to your vendor so they can have a look.

[bkaestner]

Yeah I saw this as well on VirusTotal. The funny thing is, the previous release has a binary that's almost identical but that is fine.

The previous release (2.0.2) also already contains "malware", according to both Avast and AVG. Now, Win64:Malware-gen is as generic as it can be, but 2.0.3 contains Artemis according to Skyhigh, which is supposed to be a fake trojan for a support scams? I guess that the built-in browser triggers that warning, but I don't use Avast, AVG nor SWG.

Here are the reports:

Version	Flags	Report
2.0.1	0/71 ✔️	https://www.virustotal.com/gui/file/9a181f30deb1d7ce2267f04e90ac49e72bd1886d6530a6b3e7d2d280c927b3a9
2.0.2	2/70 ⚠️	https://www.virustotal.com/gui/file/6f8c345efc07e2bcaebd48ec8042ef86622503770a1508d6d9a63ca3d2351bf9/details
2.0.3	3/68 ❗	https://www.virustotal.com/gui/file/52555f3fe69d2077afb4df81ee2b32c70889cce1b269b001f609b6986f935a67

Unfortunately, those VT reports don't contain any additional information, e.g. the location of the finding within the installer, or the nature of the "malware".

(Note. I use "malware" in quotes, because I doubt that the installer actually contains malware)

EDIT: The non-tray syncthing version has similar issues, see Bill-Stewart/SyncthingWindowsSetup#84. Yay for overly eager AV that doesn't detect dependency injections...