# Virus in gvgen.exe? **URL:** \ **Category:** Dev\ **Created:** [July 1, 2020, 6:04am UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229 "2020-07-01T06:04:51Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![magjac](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/magjac/32/16_2.png) [@magjac](https://forum.graphviz.org/u/magjac)\ **Post date:** [July 1, 2020, 6:04am UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/1 "2020-07-01T06:04:51Z")
Windows 10 claims this: ![image](https://global.discourse-cdn.com/graphviz/original/1X/db7c6bc4264af14eecba1e038707ce6265ec40b7.png) It occurs while copying the install directory with: ```auto ~/graphviz-windows$ cp -rp /c/Program\ Files\ \(x86\)/Graphviz\ 2.44.1 32/exe cp: cannot open '/c/Program Files (x86)/Graphviz 2.44.1/bin/gvgen.exe' for reading: Permission denied ``` It’s 100% repeatable. I got no warning while installing it. Perhaps someone of our more proficient Windows users can tell if this is for real or not? A quick scan with Windows defender also revealed: ![image](https://global.discourse-cdn.com/graphviz/original/1X/697814b015057a2abcf94d581fb7af4bf1881f03.png) ---
**Author:** ![magjac](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/magjac/32/16_2.png) [@magjac](https://forum.graphviz.org/u/magjac)\ **Post date:** [July 1, 2020, 6:06am UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/2 "2020-07-01T06:06:54Z")
Following the `Learn more` link leads to: [https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AWin32%2FWacatac.C!ml&threatid=2147749372](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3aWin32%2fWacatac.C!ml&threatid=2147749372) ---
**Author:** ![magjac](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/magjac/32/16_2.png) [@magjac](https://forum.graphviz.org/u/magjac)\ **Post date:** [July 1, 2020, 6:18am UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/3 "2020-07-01T06:18:10Z")
FWIW, I downloaded and ran the [F‑Secure Free Online Scanner](https://www.f-secure.com/en/home/free-tools/online-scanner) and it detected nothing: ![image](https://global.discourse-cdn.com/graphviz/original/1X/0c23203cc050aca64c50e0a0cbd71cfe62efd171.png) ---
**Author:** ![mark](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/mark/32/84_2.png) [@mark](https://forum.graphviz.org/u/mark)\ **Post date:** [July 1, 2020, 6:40am UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/4 "2020-07-01T06:40:10Z")
Perhaps try uploading to VirusTotal? That will test against every antivirus ---
**Author:** ![magjac](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/magjac/32/16_2.png) [@magjac](https://forum.graphviz.org/u/magjac)\ **Post date:** [July 1, 2020, 7:40am UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/5 "2020-07-01T07:40:59Z")
I love Windows: ![image](https://global.discourse-cdn.com/graphviz/original/1X/8d9bf1d2970962ab2497a4f1d44fca56ddcb658b.png) ---
**Author:** ![magjac](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/magjac/32/16_2.png) [@magjac](https://forum.graphviz.org/u/magjac)\ **Post date:** [July 1, 2020, 7:58am UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/6 "2020-07-01T07:58:23Z")
I unpacked the **MSBuild** `.zip` file on an Ubuntu 18.04 system and got this: ![image](https://global.discourse-cdn.com/graphviz/original/1X/eac8ccefc82d420c43cb2ad6091fd5b8715e3a31.png) Note that is is not exactly the same file since the first file is what the **CMake** `.exe` installer installed on my Windows 10 computer. ---
**Author:** ![magjac](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/magjac/32/16_2.png) [@magjac](https://forum.graphviz.org/u/magjac)\ **Post date:** [July 1, 2020, 7:59am UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/7 "2020-07-01T07:59:34Z")
> **[VirusTotal](https://www.virustotal.com/gui/file/371d16f4d0a42966b51b1f85773b1c62b803a8968c0d35c75ab1963b5cc34571/details)** > > VirusTotal ---
**Author:** ![smattr](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/smattr/32/85_2.png) [@smattr](https://forum.graphviz.org/u/smattr)\ **Post date:** [July 1, 2020, 2:01pm UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/8 "2020-07-01T14:01:02Z")
This is not good. Do we need to pull the installer packages? The packaging happens during CI, right? So does this mean the build VMs are compromised? On the other hand, @magjac one of your problems is about given.exe from 2.44.1 and the other problem is about neato.exe from 2.45.202… This suggests to me that maybe you have a local infection spreading between files you access. Maybe run a full scan of your Windows machine with Defender? ---
**Author:** ![magjac](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/magjac/32/16_2.png) [@magjac](https://forum.graphviz.org/u/magjac)\ **Post date:** [July 1, 2020, 2:21pm UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/9 "2020-07-01T14:21:04Z")
> [@smattr](#): > > On the other hand, @magjac one of your problems is about given.exe from 2.44.1 and the other problem is about neato.exe from 2.45.202… This suggests to me that maybe you have a local infection spreading between files you access. Maybe run a full scan of your Windows machine with Defender? I will do this as soon as I can, but now I’ve rebooted to Ubuntu 18.04 again to code for money (impossible on Windows). 🤑 I think it would be good if someone else but me tried the unzip and test on VirusTotal which you can do with any OS. My guess is you will see the same thing as me. I have a hard time believing that I have a virus on the Ubuntu 18.04 computer I did that test with. ---
**Author:** ![smattr](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/smattr/32/85_2.png) [@smattr](https://forum.graphviz.org/u/smattr)\ **Post date:** [July 1, 2020, 2:37pm UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/10 "2020-07-01T14:37:47Z")
I get the same result for the msbuild release zip. It finished almost immediately, so I think they just hashed the file and showed me the cached result from your run. I get the following results for other artifacts: - gvgen.exe from the msbuild debug zip is also detected by SecureAge APEX, but not MaxSecure. - The CMake 32-bit installer is detected by SecureAge APEX, MaxSecure, Bkav, VBA32 - The CMake 64-bit installer is also detected by the same 4 engines I am guessing that maybe this is a false positive, given I have never heard of any of these AV products. @magjac when you get back to your Windows machine, can you try running a Windows Defender update and see if Microsoft have releases new definitions that change the result? ---
**Author:** ![magjac](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/magjac/32/16_2.png) [@magjac](https://forum.graphviz.org/u/magjac)\ **Post date:** [July 1, 2020, 2:39pm UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/11 "2020-07-01T14:39:35Z")
> [@smattr](#): > > @magjac when you get back to your Windows machine, can you try running a Windows Defender update and see if Microsoft have releases new definitions that change the result? Will do later tonight. ---
**Author:** ![magjac](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/magjac/32/16_2.png) [@magjac](https://forum.graphviz.org/u/magjac)\ **Post date:** [July 1, 2020, 9:12pm UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/12 "2020-07-01T21:12:04Z")
My virus definitions were up-to-date. I started a full scan, but then the computer became useless and the estimated time was around 2.5 h, so I’m going to let it run overnight instead. ---
**Author:** ![magjac](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/magjac/32/16_2.png) [@magjac](https://forum.graphviz.org/u/magjac)\ **Post date:** [July 2, 2020, 6:36am UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/13 "2020-07-02T06:36:29Z")
That 🤬 Windows computer went to sleep when I did. It was 90% complete when I had to cancel the scan. It said `Time left: 1:05:36` but counted around 1 second per minute (and not always down 🙃). It hadn’t reported any viruses yet. ---
**Author:** ![mark](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/mark/32/84_2.png) [@mark](https://forum.graphviz.org/u/mark)\ **Post date:** [July 2, 2020, 6:48am UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/14 "2020-07-02T06:48:11Z")
FWIW I’d expect this is a false positive. Virus patterns are notoriously error prone… all the same it’s our problem to fix :-/ ---
**Author:** ![magjac](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/magjac/32/16_2.png) [@magjac](https://forum.graphviz.org/u/magjac)\ **Post date:** [July 2, 2020, 7:02am UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/15 "2020-07-02T07:02:31Z")
I think so too. If this persists; I’m going to try [submitting it to Microsoft for analysis](https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/submission-guide). ---
**Author:** ![scnorth](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/scnorth/32/89_2.png) [@scnorth](https://forum.graphviz.org/u/scnorth)\ **Post date:** [July 4, 2020, 3:17pm UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/16 "2020-07-04T15:17:23Z")
Thank you for doing this. I’ve never seen this before. Please let me know if you would like me to ask someone at Microsoft for help if standard channels do not work quickly enough. ---
**Author:** ![magjac](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/magjac/32/16_2.png) [@magjac](https://forum.graphviz.org/u/magjac)\ **Post date:** [July 8, 2020, 6:08pm UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/17 "2020-07-08T18:08:27Z")
I suspect this is related: > **[Security issue with uploaded binary (#1760) · Issues · graphviz / graphviz ·...](https://gitlab.com/graphviz/graphviz/-/issues/1760)** > > Steps to reproduce Go to https://graphviz.org/download/ Click- "Stable Windows install packages" Go to- If someone else wants to have a go with Microsoft on this, please go ahead. I don’t have the energy or the bandwidth at the moment. ---
**Author:** ![mark](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/mark/32/84_2.png) [@mark](https://forum.graphviz.org/u/mark)\ **Post date:** [July 9, 2020, 2:06am UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/18 "2020-07-09T02:06:51Z")
I don’t think that issue is related, I think that issue is an antivirus just configured to block any unknown binary (so it would be working as intended to block graphviz) ---
**Author:** ![smattr](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/smattr/32/85_2.png) [@smattr](https://forum.graphviz.org/u/smattr)\ **Post date:** [July 10, 2020, 2:32am UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/19 "2020-07-10T02:32:05Z")
> [@magjac](#): > > If someone else wants to have a go with Microsoft on this, please go ahead. I don’t have time right now to do this myself either, but should we create a Gitlab issue to track this? ---
**Author:** ![mark](https://sea2.discourse-cdn.com/graphviz/user_avatar/forum.graphviz.org/mark/32/84_2.png) [@mark](https://forum.graphviz.org/u/mark)\ **Post date:** [July 10, 2020, 3:43am UTC](https://forum.graphviz.org/t/virus-in-gvgen-exe/229/20 "2020-07-10T03:43:30Z")
Sure, gitlab issue sgtm