Trojan.Win64.Themida on compiled applications!
lazarus / 67-Windows

----------------------------------------------------------------------
Alienizering · 2023-04-25 00:31

After compiling my application with the latest Lazarus and scanning
the exe with virustotal.com I get this virus alert...

Trojan.Win64.Themida

and so does Google Drive.

Anyone have the same problem or have an idea as to why?

Same problem on a fresh Windows 10/64 install and only Lazarus
installed!

----------------------------------------------------------------------
KodeZwerg · 2023-04-25 01:06

I can not confirm but for a real test a source to compile would be
needed.
My own tries having most often one or two unimportant false alarms.
Lazarus 2.3.0 (rev 53b17f5614) FPC 3.2.2 x86_64-win64-win32/win64

----------------------------------------------------------------------
KodeZwerg · 2023-04-25 01:17

Quote from: Alienizering on April 25, 2023, 02:31:43 amSame problem on
a fresh Windows 10/64 install and only Lazarus installed!I am curious
about what you mean with phrase "fresh install".
Are you using a Windows installation media (DVD) or install from a
probably infected media (Backup drive)?
Are you installing Lazarus from a probably infected media or fresh
from web?

----------------------------------------------------------------------
Alienizering · 2023-04-25 05:59

Thanks for your reply.

A fresh install with a genuine Windows DVD, no other software
installed, only the latest Laz download.

If I remove all the code for http access, I don't get that virus
alert. That is, removing the opensslsockets and fphttpclient units and
of course rem out my code that uses them.

----------------------------------------------------------------------
Martin_fr · 2023-04-25 10:10

Quote from: Alienizering on April 25, 2023, 07:59:53 amIf I remove all
the code for http access, I don't get that virus alert. That is,
removing the opensslsockets and fphttpclient units and of course rem
out my code that uses them.

That does sound like a false positive. How many of the AV engines on
Virustotal return the alert? If the manufacturers have websides, they
will usually have an option to upload false positives. And then they
check it more detailed and update the signatures.

----------------------------------------------------------------------
Alienizering · 2023-04-25 15:36

Quote from: Martin_fr on April 25, 2023, 12:10:33 pmThat does sound
like a false positive. How many of the AV engines on Virustotal return
the alert? If the manufacturers have websides, they will usually have
an option to upload false positives. And then they check it more
detailed and update the signatures.

Yes it is as only Google report it as a trojan, no others do. The
problem is, I have my app on Google Drive for people to download but
now, Google tells me that if I upload more infected files, I will be
banned and my download is not available until I correct the problem.
Doing the "report as an error" does nothing, Google never look at the
file to correct their false positive.

I can do without Google Drive but it's just annoying and I would like
to know which component does that or if it's just a compiler thing.