https://sourceforge.net/p/launch4j/bugs/233/2024-04-26T09:15:54.897000ZRecent changes to 233: Virus Total detections in 3.50 - false positives - Jiangmin/Zillya - worgtop2024-04-26T09:15:54.897000Z2024-04-26T09:15:54.897000ZStefan Schröderhttps://sourceforge.net/u/ssc9632134/https://sourceforge.net3d1eb42d6aff8c923d78c11f66b9788824ea91a5

<div class="markdown_content"><p>Hi team,</p> <p>we currently see reports from two scanning engines on Virus Total reporting on downloadable ZIP package "launch4j-3.50-win32.zip" from sourceforge. See screenshot attached. This was confirmed using different systems in different networks to rule out local infections.</p> <p>It is highly probable that this is a false positiv from the scanning engines "Jiangmin" and "Zillya". </p> <p>We see the same very reports on exe files created for our jar with launch4j 3.50 signed with Microsoft signtool.</p> <p>We use the maven plugin to run launch4j exe creation. We run the creation process on different build systems.</p> <p>Question is how to deal with this? I contacted Zillya! support if they can confirm it is a false positive.</p> <p>There are some other tickets open regarding similar issues. But the ideas - like code signing - brought up there do not seem to work.</p> <p>All the best <br/> SSC</p></div>