Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Windows Reports SpleeterGUI.exe as threat #36

Closed
Windowsurfer opened this issue Jul 15, 2020 · 33 comments
Closed

Windows Reports SpleeterGUI.exe as threat #36

Windowsurfer opened this issue Jul 15, 2020 · 33 comments
Labels
Fixed

Comments

@Windowsurfer
Copy link

Windowsurfer commented Jul 15, 2020 •
edited
Loading

Windows reports SpleeterGUI.exe as threat and puts it in quarantine.

Trojan:MSIL/Formbook.VN!MTB
@boy1dr
Copy link
Owner

boy1dr commented Jul 15, 2020

Thanks for reporting this i'll take the download offline until i can work out what happened there.
My windows defender didn't pick it up and neither did malwarebytes but now it does, strange.
I wonder if this is a false positive. will need to test more before i post another file for download.

@bascurtiz
Copy link

@boy1dr
Just popped up for me too:
"Trojan:MSIL/Formbook.VN!MTB"

However it didn't when installing a week ago.
So prolly false-positive.

You can manually let Microsoft review your .exe here: https://www.microsoft.com/en-us/wdsi/filesubmission/
I had to do this myself one time, and after reviewing instantly another 9 'virusscanners' on virtustotal.com determined my exe as OK =)

@khunjiwon
Copy link

Hi, the same thing happened to me today. I will do a review submission as per @bascurtiz .

@boy1dr
Copy link
Owner

boy1dr commented Jul 16, 2020

I have submitted it for review as the developer. Thanks @bascurtiz for the suggestion.
Hopefully they get back to us soon :)

@boy1dr boy1dr added the In progress It's being worked on label Jul 16, 2020
@helil
Copy link

helil commented Jul 16, 2020

Just to let you know...
I got it too:
Trojan:MSIL/Formbook.VN!MTB
15/07/2020 22:16

@Scunkaneli
Copy link

Scunkaneli commented Jul 16, 2020 •
edited
Loading

12 hours ago 2/72, currently 4/72
https://www.virustotal.com/gui/file/e0baa6e31f3c5243789798321b2817ba69db57f7e55f96f056a18495931fbe14/detection
Info about FormBook: https://blog.talosintelligence.com/2018/06/my-little-formbook.html

@boy1dr
Copy link
Owner

boy1dr commented Jul 16, 2020

I just downloaded this repository on another machine, defender removed the pre-compiled binaries as expected.
I loaded the solution in Visual C#2017 and ran it in debug mode. defender nuked the compiled exe immediately.

This is definitely a false positive so we just have to wait for Microsoft to give it the all clear.
Feel free to check over the code (form1.cs) and compile the project yourself if you need to be sure.

@Windowsurfer
Copy link
Author

Windowsurfer commented Jul 17, 2020 •
edited
Loading

Why does it recognize FormBook actually? Is it actually part of the software? Or is there any idea how this got recognized?
(Let it be mentioned: I'm not familiar with software programming at all)

@boy1dr
Copy link
Owner

boy1dr commented Jul 17, 2020

@Windowsurfer
anti-virus software cannot actually look in all your files for all the known viruses that exist.
Instead they rely on pattern matching (otherwise known as heuristics).
Occasionally those known virus patterns can appear in other software code and cause whats known as a false positive.

@boy1dr
Copy link
Owner

boy1dr commented Jul 17, 2020

It has been cleared by MS but it will still detect as a trojan until defender updates it's definitions file

Analyst comments:

We have removed the detection. Please follow the steps below to clear cached detection and obtain the latest malware definitions.

 1. Open command prompt as administrator and change directory to c:\Program Files\Windows Defender   
 2. Run “MpCmdRun.exe -removedefinitions -dynamicsignatures”  
 3. Run "MpCmdRun.exe -SignatureUpdate"

Alternatively, the latest definition is available for download here: https://www.microsoft.com/en-us/wdsi/definitions

Thank you for contacting Microsoft.

@boy1dr
Copy link
Owner

boy1dr commented Jul 18, 2020 •
edited
Loading

FYI defender still appears to be identifying the tojan even though Microsoft have cleared it.

Microsoft_Security_submission

Manually running the commands (see above) provided by Microsoft seems to have done the trick today.

@jaromanda
Copy link

Defender no longer identifies malware in this - just updated defender about 5 minutes ago, and re-installed, all good

@boy1dr boy1dr added Fixed and removed In progress It's being worked on labels Jul 22, 2020
@boy1dr
Copy link
Owner

boy1dr commented Jul 26, 2020

New version 2.7 was released yesterday and again today MS defender has identified it as the same trojan.
I have sent the file to Microsoft today and they gave it the all clear.
Based on last time it might take a few days for your defender cache to clear and allow my app once more.

@boy1dr boy1dr mentioned this issue Jul 26, 2020
Closed
@ilazarte
Copy link

Please keep us updated, this info should probably be posted on the readme.

@boy1dr
Copy link
Owner

boy1dr commented Jul 27, 2020

@ilazarte readme has been updated. i was hoping defender would update quicker this time but sadly it has not.

@boy1dr
Copy link
Owner

boy1dr commented Jul 27, 2020

Defender appears to still be detecting trojan even though it has been cleared by Microsoft 2 days ago.
Checking the submission report this morning shows the following
Microsoft_Security_submission2 7

@boy1dr boy1dr mentioned this issue Jul 27, 2020
Closed
@boy1dr
Copy link
Owner

boy1dr commented Aug 1, 2020

Version 2.8 is now available.
I have compiled this version as 64bit to avoid defender false positives.

@Nabs617
Copy link

Nabs617 commented Nov 22, 2020

Hey, 2.9 just came up as a positive today. Both the .exe and shortcut were said to have a virus according to Microsoft. Trojan:Win32/Fuery.C!cl

@boy1dr
Copy link
Owner

boy1dr commented Nov 22, 2020

@Nabs617 Thanks for confirming this. i also got the notification earlier today.
This would be the 4th time i have had to fight Microsoft to clear my name. this is open source software and the exe i provide is for the convenience of those that would want to use it. i can assure you that is it virus free, these detection are false positives.
If you are concerned feel free to download the source code and compile it yourself.
The code signing certificate to prove the projects authenticity is AUD$500/year. hosting for this project is ridiculous at 2-4 terabytes per month and donations hovering around the AUD$40/month. I have funded this project for 12 months now and come new year i will pull the project after one final software release.
If you are willing to take on the project let me know, hopefully someone out there will take it on.
I'm not angry, i'm just over it. i hope you can understand :/

@Nabs617
Copy link

Nabs617 commented Nov 22, 2020

@boy1dr Hey, I totally understand. I hope things work out for you and the project, I'd hate to see it go.

@SJegorovs
Copy link

[email protected] @boy1dr

I downloaded the MSI-version of spleeterGUI 2.9.1 and installed it, but I get an error window "can't find python.exe". So I downloaded the actual zip-version. Now the defender of Windows 10 say "Trojan:MSIL/Formbook.VN!mtb" detected. I'm updating the database of the defender regulary.

So my question: is there a trojan in the spleeterGUI.exe? When not, can I allow the defender to run the exe on my PC without the risk to catch a trojan?

A short Feedback will be nice.

1 similar comment
@SJegorovs
Copy link

[email protected] @boy1dr

I downloaded the MSI-version of spleeterGUI 2.9.1 and installed it, but I get an error window "can't find python.exe". So I downloaded the actual zip-version. Now the defender of Windows 10 say "Trojan:MSIL/Formbook.VN!mtb" detected. I'm updating the database of the defender regulary.

So my question: is there a trojan in the spleeterGUI.exe? When not, can I allow the defender to run the exe on my PC without the risk to catch a trojan?

A short Feedback will be nice.

@boy1dr
Copy link
Owner

boy1dr commented Aug 29, 2021

@SJegorovs Hi mate. the 32bit version of SpleeterGUI often gets flagged as having a formbook trojan. As per Microsoft's advice i switched to 64bit and it's been fine ever since. be sure to use the latest version.
if you get "cant find python". in SpleeterGUI click Help > Set path, then choose your SpleeterGUI path.
Mine is C:\Users\chris\AppData\Roaming\SpleeterGUI
Change "chris" for your path.

@SJegorovs
Copy link

@boy1dr Chris,

many thanks for your quick reply to me on a Sunday.

How I can switch to 64 Bit?

The error window disappeared and after starting the Gui it Shows spleeter Version 2.1.2

But when I try to seperate 2 steams, I get an error in "pywrap_tensorflow.py" line 64 in from tensorflow\python_pywrap_tensorflow_internal Import * and now steam will be exported.

Is there so thing missing in the Installation?

I've also the spleeterGUI_V2.0.zip. Will I find there the missing things?

It will be nice to hear back from you again.

Best regards
Svens

@boy1dr
Copy link
Owner

boy1dr commented Aug 29, 2021

Please post the entire output so i can see whats going wrong.
Also you will need to be running SpleeterGUI v2.8 or v2.9. Previous versions where 32bit and was being detected as a trojan.

@SJegorovs
Copy link

SJegorovs commented Aug 30, 2021 via email

@boy1dr
Copy link
Owner

boy1dr commented Aug 30, 2021

@SJegorovs i'll do my best to help out. i can't find your attached output though. can you paste it in here directly ?

@SJegorovs
Copy link

SJegorovs commented Aug 30, 2021 via email

@boy1dr
Copy link
Owner

boy1dr commented Aug 30, 2021

@SJegorovs near the end it says "ImportError: DLL load failed: Eine DLL-Initialisierungsroutine ist fehlgeschlagen."
This is listed as the # 1 common issue with Spleeter on my help site https://makenweb.com/spleeter_help
It would appear that you are trying to run Spleeter on a CPU that does not have the instruction set it requires to run.

@SJegorovs
Copy link

Dear Chris,

thanks for your reply so quick. Do that mean, that I cannot run spleeter on my PC any way?

Best regards
Svens

@SJegorovs
Copy link

SJegorovs commented Aug 30, 2021 via email

@boy1dr
Copy link
Owner

boy1dr commented Aug 30, 2021

According to https://versus.com/en/amd-e-350-vs-intel-core-i3-2365m
You CPU does not have the AVX instruction set that spleeter requires to run.
I'm not sure of free alternatives but RX-8 is great at source separation.
There are various websites offering Spleeter you could try those. not sure how free they are.
try splitter.ai

@bascurtiz
Copy link

@SJegorovs @boy1dr
I'd advice you to look into my comparison I did a year ago:
https://www.reddit.com/r/IsolatedTracks/comments/hhjczd/ai_separation_comparison/

My opinion:
Lalal.ai was/is best, but is paid by now.
Ultimate Vocal Remover v5 is next best, if not best right now:
https://youtu.be/F2EeRok6uo4

@boy1dr boy1dr closed this as completed Apr 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Fixed
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
10 participants
@helil @ilazarte @boy1dr @jaromanda @Scunkaneli @bascurtiz @Windowsurfer @khunjiwon @Nabs617 @SJegorovs