Author Topic: MusicBee reported as virus/trojan  (Read 44646 times)

vpsaxman

  • Full Member
  • ***
  • Posts: 197
[MOD: For reports with 3.4 see https://getmusicbee.com/forum/index.php?topic=18398.msg181888#msg181888]


Both Chrome and MS Defender returned a trojan warning when downloading the latest MB zip file (final release candidate). I'm sure it's a false positive, but it wasn't a problem for previous releases.

Here's MS relevant webpage: https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=Trojan%3aWin32%2fFethar.B!cl&threatid=-2147258321&enterprise=0
Last Edit: October 17, 2020, 03:52:09 PM by psychoadept

Nick

  • Jr. Member
  • **
  • Posts: 23
I have the same issue. Windows Defender was very aggressive about it. I assume it's nothing, but I'll hold off on upgrading for now.

phred

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 9299
Assuming you're downloading from the MusicBee website, it's a false positive.  You can run it through Virus Total to confirm: https://www.virustotal.com/en/
Download the latest MusicBee v3.5 or 3.6 patch from here.
Unzip into your MusicBee directory and overwrite existing files.

----------
The FAQ
The Wiki
Posting screenshots is here
Searching the forum with Google is  here

Steven

  • Administrator
  • Sr. Member
  • *****
  • Posts: 34312
i dont know what to make of this. The last release candidate was also reported by one or two people and then the issue disappeared after that (i assume with a later windows defender definition file). The thing is I use windows defender myself and never had issues (just ran a Scan Now to reconfirm). Also downloaded on another windows 10 machine/ windows defender and no issues reported.

Trying with VirusTotal, there is 1 out of 56 reporting a virus
Rising    Malware.Undefined!8.C-zFh4eF8usxI (Cloud)    20160508
but microsoft is not one of them

galactica12

  • Jr. Member
  • **
  • Posts: 58
On mine personally, I'm getting a "Trojan:Win32/Fethar.B!cl" notification. Which is very odd indeed. I'll just try updating definitions again later and see if that fixes it.

EDIT: It seems being even one definition update behind seems to cause that false positive, at least on Windows Defender. Doesn't pop up again after it is updated, thankfully.

Nick

  • Jr. Member
  • **
  • Posts: 23
On mine personally, I'm getting a "Trojan:Win32/Fethar.B!cl" notification. Which is very odd indeed. I'll just try updating definitions again later and see if that fixes it.

EDIT: It seems being even one definition update behind seems to cause that false positive, at least on Windows Defender. Doesn't pop up again after it is updated, thankfully.

I just updated definitions before downloading again and I still get the report of "Trojan:Win32/Fethar.B!cl" being found.

vpsaxman

  • Full Member
  • ***
  • Posts: 197
Just updated to "Definition Update for Windows Defender - KB2267602 (Definition 1.219.1201.0)" and tried again: no virus warning this time although I got the "Windows Smartscreen" warning, but this one's been showing up for a while.


redwing

  • Guest
I don't think there's much to be concerned about. Probably this is happening as RC files include a self-extracting zip file. If not Windows Defender then a few other AV programs would always report it as malware. Don't bother with RC files. Only for the official release file, report to AV apps if they throw a false positive.

Steven

  • Administrator
  • Sr. Member
  • *****
  • Posts: 34312
i believe SmartScreen is based on some sort of reputation rating. Because its a new .exe and because its an unknown publisher then it has no reputation.
To become a recognised publisher i would need to purchase a microsoft approved certificate each year.
So when i do the final release that too will be a new .exe and will take a while before a reputation is established.
The strange thing is on my windows 10 machine which is not the machine used for developement, i downloaded and installed the file without this happening (or any of the AV warnings)

vpsaxman

  • Full Member
  • ***
  • Posts: 197
That's strange as I'm using Win 10. Oh well, no big deal. I'm not concerned about it since it's a beta version and I browse the forum regularly but it might generate some trust issues for new users.

Nick

  • Jr. Member
  • **
  • Posts: 23
It appears Steven updated the link. Not getting a false positive anymore.

mxmax

  • Guest
i just downloaded the latest release and i got the same alert for trojan and my pc removed it  now im not even sure if i should use your software anymore.

https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=Trojan%3aWin32%2fFethar.B!cl&threatid=-2147258321&enterprise=0
Last Edit: May 10, 2016, 05:27:22 PM by mxmax

phred

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 9299
i just downloaded the latest release and i got the same alert for trojan and my pc removed it  now im not even sure if i should use your software anymore.
Did you run the exe through Virus Total?  You'll find that at most one or two out of 50+ will come back with a false positive.  No one is forcing you to use MB, but trust us - if you downloaded it from the MB website, the problem is with your AV definitions and not with MB.
Download the latest MusicBee v3.5 or 3.6 patch from here.
Unzip into your MusicBee directory and overwrite existing files.

----------
The FAQ
The Wiki
Posting screenshots is here
Searching the forum with Google is  here

mxmax

  • Guest
i just downloaded the latest release and i got the same alert for trojan and my pc removed it  now im not even sure if i should use your software anymore.
Did you run the exe through Virus Total?  You'll find that at most one or two out of 50+ will come back with a false positive.  No one is forcing you to use MB, but trust us - if you downloaded it from the MB website, the problem is with your AV definitions and not with MB.

nope, i didn't run it with virus total cause i didn't even run it once it finishs downloading i got a warning from my MS virus scanner and chrome browser for a trojan then it got removed. i have removed your software from my pc after using it for 2 years, sorry i can't trust you anymore bye.

phred

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 9299
nope, i didn't run it with virus total cause i didn't even run it once it finishs downloading i got a warning from my MS virus scanner and chrome browser for a trojan then it got removed. i have removed your software from my pc after using it for 2 years, sorry i can't trust you anymore bye.
Don't you think if there was malware or a virus in the exe that out of the thousands (tens of thousands?) of MB users there would be more than two or three complaints?
Oh yee of little faith. 
Download the latest MusicBee v3.5 or 3.6 patch from here.
Unzip into your MusicBee directory and overwrite existing files.

----------
The FAQ
The Wiki
Posting screenshots is here
Searching the forum with Google is  here