3.1.5 - Trojan Virus

amcdougall

Good evening,

This evening we tried to run 3.1.5. We installed 3.1.5 two weeks ago and it ran fine until tonight. Windows defender has removed the MSI and executable, and subsequent downloads of the 3.1.5 x64 and portable x64 versions are also being flagged with a possible trojan.

I uploaded the x64 portable version to Virus Total, and they flagged from 8 different sources including Fortinet and TrendMicro. Attached below is the screenshot from Windows Defender

amcdougall

Also, I tried to download using a separate computer and the downloads are also being flagged and removed immediately.

carey

Same here, flagged as a virus in Windows 11 and it is now non-functional.

amcdougall

Screenshots from Virus Total

dcsymonds

I had the same... I've ignored the warnings for now.. but want to make sure it really is a false positive

dcsymonds

I just uploaded the OpenLP.exe for 3.1.5 and multiple sources reported as Trojan. I've removed the exception and let AVG delete it. Rolling back to 3.1.4

VirusTotal report for the OpenLP.exe: https://www.virustotal.com/gui/file/72fda7a42ed4806ea74d316a2b52195df47c446f5be8c43ec9ca474c0170cfa3

chrisinhim

kurl8rocks

I too could not install 3.1.5, so I installed 3.1.4. It ran fine on Sunday, and tonight Windows 11 has deleted it, flagging it as a virus.

Update: I added an exception to the Windows 11 AV, asking it to avoid the OpenLP folder. Windows 11 AV hasn't removed it yet.

PaulRowell

kurl8rocks I had to add another exception last night as Windows Defender detected a different virus in OpenLP.

It would be helpful if one of the development team could comment on what is happening, I'd just feel easier if they could confirm that OpenLP doesn't have a virus !

briffid

There is some technical description of the issue here: https://gitlab.com/openlp/wiki/-/wikis/Packages/Virus_False_Positives
Basically the way OpenLP is built for Windows often produces false positives 🙁

witterholt

The reason is we use PyInstaller to build the deployment package. Here is another link from that project regarding this issue: https://github.com/pyinstaller/pyinstaller/blob/develop/.github/ISSUE_TEMPLATE/antivirus.md

witterholt

I am investigating if we can prevent this false positive virus warning for future releases.

owend

witterholt Will another version be released after this gets figured out? And will it include a flatpak? There are many of us still waiting for a flatpak release of 3.1.5. The latest flatpak is 3.1.3.

witterholt

owend Yes, once we have our new CI/CD pipeline working, where this fix is a part of, I can suggest to bring out a 3.1.6 release to fix the video autoplay issue as well.

rgiesken

I managed to download and instal the 32bit version of 3.1.5 quite effortlessly - seems to avoid the virus detection issue. Is there much of a difference in performance technically? I don't seem to notice much.