py2exe generated executables show as false positives.

[Athanasius]

I'm one of the maintainers for an open source python-based project "EDMarketConnector" -

https://github.com/EDCD/EDMarketConnector/

We utilise https://github.com/py2exe/py2exe/ in order to build the application into two executables, plus supporting files.  We then bundle all those files up using the WiX toolset to create a windows installer package, e.g. EDMarketConnector_win_5.0.0.msi - https://github.com/EDCD/EDMarketConnector/releases/download/Release%2F5.0.0/EDMarketConnector_win_5.0.0.msi .

That particular file has been reported to us that "MalwareBytes Pro is also flagging and quarantining this MSI, with an alert based on AI Malware".

Our issue for this is https://github.com/EDCD/EDMarketConnector/issues/1058 .  If you check that you'll see that we link to a couple of py2exe issues about this general phenomenon: https://github.com/py2exe/py2exe/issues/86 and https://github.com/py2exe/py2exe/issues/73

Something that py2exe does in order to produce an executable from a python script keeps on tripping up various anti-virus engines as a false positive.  It would be great if you could figure out what that is and ensure your products don't flag up our files as false positives.  I'm hoping it's more in the way of something intrinsic that py2exe does (i.e. there is, I think, some code that will be manipulating things in memory when it's finding modules to load) rather than a random byte string that it happens to produce sometimes.

[shadowwar]

This file has been whitelisted. 

Thanks for reporting. 

 

[Athanasius]

Any thoughts on why py2exe seems to trigger anti-virus false positives?  We're not the first users of py2exe to experience this.  In the long run it would be best if detection could be tuned to recognise whatever it is that py2exe does as harmless.

 

Thanks.

[shadowwar]

We cant really do that  because its very abused by malware. The only solution i could think of was for you to sign the file.