Trojan detected in Binary from Auto-Update today

[F1orian]

Hello everyone.

Today I updated Twinkle Tray with the built-in update function and was quite surprised, when Windows Defender allerted me of a trojan in the "Twinkle Tray.exe" afterwards. The file was then immediately quarantined, deleted and Twinkle Tray uninstalled.

I had originally installed it from GitHub but switched to the MS Store version now. The MS Store version seems fine so far. Did anyone else have a similar experience?

[F1orian]

Virustotal also flags the file from GitHub:

https://www.virustotal.com/gui/file/63063f056eae57845d6f9c980c73be8d87365ff075cba489c2a5ceffae398e36

[xanderfrangos]

Hi @F1orian,

It looks like the file "SpiderBanner.dll" is what's flagging it, which is a DLL used in electron-builder-based installers. If you look at the report for that file, you'll see under "Execution Parents" that a number of popular apps also include this file (like Signal and Cursor). Since it's a common library used in installers, both legit apps and malware can include it without the installer itself being malicious. So it's a false alarm.

The v1.16.7 installer is from this workflow run, which used this commit. If anyone has any concerns, you're free to check the source, compare hashes, or build your own copy.