ep_setup.exe tagged as malware in virustotal

[robbiefowler]

https://www.virustotal.com/gui/file/b49e85051a2ebbc52ad69978c6419296d9c8777325261c0c082cf5f3855b8b4d
3 security vendors and no sandboxes flagged this file as malicious

Trojan.Malware.300983.susgen
Malicious
W32.Vundo.Gen

Is this safe to run?

[robbiefowler]

Version 22000.376.40.14 has 0 flags - https://www.virustotal.com/gui/file/bcc784f30d6136c14800638656b306062adfe18dd73878471455eccf22df6790

[valinet]

I already explained multiple times what goes into generating these executables. Tl;dr It’s your choice to run it or not, the builds are automatically compiled based on the public source code available. It cannot get more transparent than this. That x or y decides to flag it anyhow, I can’t do much about it, besides signing the code.

This has been discussed extensively before:

• Windows Defender reports Trojan:Win32/Spursint.Q!cl in dxgi.dll #265 (comment)
• Windows Defender reports Trojan:Win32/Spursint.Q!cl in dxgi.dll #265
• There’s a wiki entry for it as well: https://github.com/valinet/ExplorerPatcher/wiki/Antivirus-false-positives

It’s basically a false positive, the name AV vendors have for what the rest calls bugs in their products.