Open Dronelog flagged as malware on VirusTotal by Windows Only

[TimAardvark]

Hi Arpang! Your software looks brilliant, thanks for setting it up! 1st time on Github so hope it's alright for me to send this.

I downloaded the DMG file from the website (Macbook), and have ran it past VirusTotal. It was checked by 62 vendors, and the one from Microsoft is the only one to flag it, as a potential trojan:
https://www.virustotal.com/gui/file/8ea1ca7f33389289a9c363cbfe19283bd9956911864ed70b1378e60c330a8490

I know this could be flagged as a windows thing and saw your point in the Readme about the Gatekeeper security warning for unsigned apps (not a corrupted file). Running it past my ai buddy it suggested to send the link and ask the following:
Rebuild the macOS DMG, and
Publish SHA‑256 checksums and, ideally, a signed/notarised build when they can, or
Confirm that they have submitted the current DMG to Microsoft as a false positive.

Apologies if I'm missing something obvious, I don't know much about checksums etc.
You've done loads for this already, so totally up to you of course but sending for info and to see what you think, please.

Many thanks, Tim

(Edited to show my ignorance about checksums, just in case I'm missing something obvious)

[arpanghosh8453]

Hi @TimAardvark

I can give the SHA256 checksums for the files (they serve as a proof that the ), I build them with GitHub CI/CD pipeline. It runs fine on windows without any warning from Windows Defender. signed/notarised build will require me to pay them/apple to get the developer key, which I currently can't do while keeping it completely free to all users, which is one of my key requirement.

Trojan:Script/Wacatac.B!ml is a machine-learning-based heuristic detection (the !ml suffix), not a signature match against known malware. It's a very common false positive for Tauri apps.

Submitting a False positive report will whitelist this build/version hash, future ones might get the same, so that is not a solution.

I don't think I can do anything much about the false positive detection without spending money. But this project is open source, so someone can do an audit if they want to.

I will look into signpath.org - they seem to give it to qualifying projects.

No worries at all, at least you are kind enough to try your best by reaching me out here. I appreciate it :)

[TimAardvark]

Hi @arpanghosh8453

Thanks for your quick and helpful response! I get your points and understand that you've obviously put so much into this project, and are making it available for free (which is fantastic).

The SHA256 checksums would be great for peace of mind if that's cool, thank you. I wasn't sure if they were available somewhere and I missed them.

Appreciate your response and look forward to trying out your programme!

Thanks, Tim :)

[TimAardvark]

Hi @arpanghosh8453

Just checked the virustotal list again, and all 62 vendors are giving the all clear now, including Microsoft! 👍 Not sure if you did anything your way but it's great to the full set!

Thanks and all the best, Tim

[arpanghosh8453]

@TimAardvark I added checksums, as you suggested, but nothing else significant. It was a false positive anyway in my opinion. and it's a prediction - so I would go with the consensus than the one tool decision. it does not hurt to be careful though.

[TimAardvark]

@arpanghosh8453 You adding the checksums seems to have sorted it then! Yep, I'm sure it's fine but feel happier for checking. Will be good if anyone else checks now too.

Thanks again, the app looks great! Tim