neelakurdinger Posted October 27, 2014 ID:897152 Share Posted October 27, 2014 I am sorry if this thread doesn't belong here but I would like to point out something strange about Mcafee labs. I have been using nsis installer as a developer and mcafee always pops alerts with programs that uses nsis. This is complete and utter nonsense. What's even more weird is it detects even an empty installer as a threat. I have done virustotal scan of an empty installer and here are the results https://www.virustotal.com/en/file/755f5eb13371bf03b5e8d4398869e0b1a19b189b7214d8cfe516bda9b951748b/analysis/1412582177/ you can clearly see that mcafee detects it as a BehavesLike.Win32.Dropper.nh Any thought or feedback toward this will be highly appreciated Link to post Share on other sites More sharing options...
David H. Lipman Posted October 27, 2014 ID:897154 Share Posted October 27, 2014 Have you tried to UPX pack the installer ? Link to post Share on other sites More sharing options...
neelakurdinger Posted October 28, 2014 Author ID:897748 Share Posted October 28, 2014 Have you tried to UPX pack the installer ? Actually it's not about that. I have downloaded official nsis installer http://sourceforge.net/projects/nsis/files/NSIS%203%20Pre-release/3.0b1/nsis-3.0b1-setup.exe/download?use_mirror=switch&download= even the installer itself is detected as a possible threat from Mcafee. Look at the results https://www.virustotal.com/en/file/7e5c203584c538205b345d91249fca8af03a8cf186c8c870a86374812d8103a5/analysis/ We have also submitted a report for a false positive and found similar threads on mcafee community https://community.mcafee.com/message/355351#355351 Link to post Share on other sites More sharing options...
David H. Lipman Posted October 28, 2014 ID:897755 Share Posted October 28, 2014 Well the idea is if you create a NSIS packaged installer, one would then UPX pack it. That would obfuscate the NSIS package. Link to post Share on other sites More sharing options...
neelakurdinger Posted October 29, 2014 Author ID:898527 Share Posted October 29, 2014 Well the idea is if you create a NSIS packaged installer, one would then UPX pack it. That would obfuscate the NSIS package. Yes but I am here talking about I can't have even official nsis installer on my computer without mcafee detecting it as a threat. Link to post Share on other sites More sharing options...
David H. Lipman Posted October 29, 2014 ID:898535 Share Posted October 29, 2014 * Don't use McAfee * Exclude the folders in which you process NSIS packaged installers * Use a different package installer Link to post Share on other sites More sharing options...
neelakurdinger Posted October 29, 2014 Author ID:898543 Share Posted October 29, 2014 Yeah well I will not use Mcafee anymore but most of the programs we provided to our clients are using nsis installer and same clients who use Mcafee started complaining a lot. Link to post Share on other sites More sharing options...
David H. Lipman Posted October 29, 2014 ID:898553 Share Posted October 29, 2014 Right. But that's why you take the NSIS packaged installer that you create and then you UPX pack the installer. Then the recipients who get the final product will see the installer as a UPX packed binary. It is worth testing - isn't it ? Link to post Share on other sites More sharing options...
neelakurdinger Posted October 30, 2014 Author ID:899359 Share Posted October 30, 2014 Right. But that's why you take the NSIS packaged installer that you create and then you UPX pack the installer. Then the recipients who get the final product will see the installer as a UPX packed binary. It is worth testing - isn't it ? Hmm when you put it like that I wanna test it. Let's see I will tell you how it went with UPX packer. However just to raise awareness if anyone face the same problem, don't hesitate join the conversation in community of mcafee https://community.mcafee.com/message/355351#355351 Link to post Share on other sites More sharing options...
David H. Lipman Posted October 30, 2014 ID:899361 Share Posted October 30, 2014 Thanx for the update. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now