VirusTotal Trojan Alert for Cryptomator-1.6.14-x64.exe

Help Desktop App
1

Hey,
after downloading Cryptomator-1.6.14-x64.exe from the official site Thank you for downloading Cryptomator! I wanted to check with VirusTotal if the exe-file was fine.

I then got an alert that the exe-file should contain the following trojan:
DrWeb - Trojan.Siggen18.12944 - Acronis (Static ML)

The SHA256-sum I double-checked already with the official download-page and it’s the same.
Therfor it might be a false positive but could somebody from the team please double check and maye request deleting that alert from VirusTotal?

Thanks a lot!

2

Hey and welcome to the Cryptomator Community :slightly_smiling_face:,

Thanks for pointing that out, we will look into it right away and get back to you.

3

Here is the link to the report VirusTotal

VirusTotal notes the following about false positives https://support.virustotal.com/hc/en-us/articles/115002122305-VirusTotal-is-detecting-a-legitimate-software-I-have-developed-what-can-I-do- and https://support.virustotal.com/hc/en-us/articles/115002121185-I-am-experiencing-a-false-positive-my-file-or-site-should-not-be-detected- that is why we contacted Acronis to know more about their allegations.

1 Like
4

Acronis answered the following:

The mentioned software and detection coverage from VirusTotal shows a clean and undetected analysis report as for Acronis (Static ML).

Which basically means Acronis (Static ML) didn’t find something. We both misinterpreted the results page as it states Undetected but it is really strange why Trojan.Siggen18.12944 is mentioned.

We are still trying to figure out what is causing the display problem in VirusTotal, whether Acronis is reporting this incorrectly to VirusTotal or whether VirusTotal is misinterpreting the report from Acronis but these are “details” so to speak, the important thing is that Acronis has not found anything.

5

Mhm, am I missing something? The report does show Acronis as clean, but DrWeb with the virus result. So I would have assumed that DrWeb is the Company to ask why they show this, isn’t it?

2 Likes
6

:man_facepalming: Oh man, you’re so right^^ missed the missing table separator in the center, it’s not one entry per line. Thank you Michael, will write another mail :sweat_smile: :joy:

2 Likes
7

Wow, that took a while until DrWeb (Virus Monitoring Service Doctor Web Ltd) fixed the false positive but finally Cryptomator is all green again on VirusTotal :tada:

1 Like
8

Bitdefender:
C:\ProgramData\Package Cache\cryptomator-bundle-winfsp\winfsp.msi=>(Embedded CAB)=>winfsp_a64.sys : Trojan.GenericKD.63667777

9

@Papazol What version of Cryptomator is installed on your system? This should be a false positive.

Interestingly, the virus total anaylsis of the winfsp.msi shows no detection for Bitdefender: VirusTotal

10

Hi,
1.6.14 (msi-3947)