@boreal glade
Python help channel opened
#🔒 executable being marked as a virus
open flickerBOT
Python help channel opened
neat trail
Yes. That's part of the tradeoff of packaging the code as an executable.
opaque storm
Unfortunately enough malicious actors have used PyInstaller and the executables it creates have gained a bad reputation.
The official or proper solution would be get your executables signed, but if that's not possible, you'll need to look at alternatives
boreal glade
so pyinstaller puts malicious code in the clean code?
opaque storm
No, it's just that other executables created using PyInstaller have been identified as malware. Windows Defender would've learned that markers common to all PyInstaller executables shouldn't be trusted.
boreal glade
so the executable i made was safe?
opaque storm
I mean, I'm not going to claim with 100% certainty that PyInstaller isn't injecting malware, but AFAIK, it is safe
It's just that PyInstaller executables as a group have gained a poor reputation due to malicious actors and thus all of them, even the perfectly safe executables, are treated as malicious.
boreal glade
What can i use to make safe executables that won't get flagged
opaque storm
You could try cx_freeze or Nukita, but I don't know if they won't be flagged by Windows either
It's an unfortunate reality. Python is a common language malware is written in and tools to package Python code into an executable are often used to package malware, and thus, AVs have learnt to treat all executables with Python code inside as harmful.
boreal glade
so no matter what i use it's gonna get flagged?
opaque storm
well, those tools are a worth a shot, but there's nothing to guarantee your perfectly safe executable won't be wrongly flagged by Smart Screen (which is the part of Windows responsible for these warnings)
marsh vault
Any unsigned executable will be flagged by SmartScreen if downloaded from the internet
To sign it, you have to buy a certificate (it's really not worth it)
Why do you need to freeze it anyways ?
boreal glade
wdym?
marsh vault
Which message ?
marsh vault
wdym?
If your .exe file doesn't specifically contains a certificate that says "this is all good", then when you download it windows will say "are you sure you want to run this ?"
boreal glade
nvm it doesnt support my python version
marsh vault
Why do you need to freeze it anyways ?
And freeze means converting to an exe
boreal glade
And freeze means converting to an exe
oh bc how else would you run games or any software
marsh vault
Doesn't it only says "this file is not verified" ?
boreal glade
wait lemme open windows defender rq
boreal glade
no i just wanna show what it says when i try to run the exe file
boreal glade
yuh
marsh vault
Yep that's SmartScreen
marsh vault
Huh
boreal glade
marsh vault
Uuh
boreal glade
from the same file
marsh vault
Run an antivirus scan
This is likely a real virus that implemented itself in your pyinstaller file
boreal glade
i removed it soon as i got the noti but i scan again
no threats found
I removed them all already
marsh vault
Remake it ig
boreal glade
got the file
marsh vault
So ?
marsh vault
Can you send the link ?
boreal glade
marsh vault
That's a virus
It's dropping files in System32
Big red flag
Your computer has a trojan
boreal glade
but av says it's clean
marsh vault
It's elaborated
boreal glade
?
marsh vault
It's barely detectable
But AVs that use sandboxes do flag it
This is virus behavior btw
It's a cryptominer
My condolences
boreal glade
It's barely detectable
what you tryna say?
boreal glade
Are you tryna suggest that part of the virus could still exist somewhere?
marsh vault
There is a cryptominer on your computer
boreal glade
and that is what exactly?
marsh vault
That's using your resources to try and bruteforce a code from cryto transactions
boreal glade
like virtual purchases?
marsh vault
So when someone make a transaction in bitcoin for example
There is a code that is generated
If someone finds it, he can get a part of the money that's exchanged
boreal glade
So when someone make a transaction in bitcoin for example
like recent purchases or on going?
boreal glade
pfff gl i never made any purchases so ain't no one gonna find anything
marsh vault
No
Not your purchases
People that purchase and transfer bitcoin
And other cryptocurrencies
boreal glade
like through crypto apps like meta mask?
boreal glade
again ain't gone find anything bc ain't nun on there
marsh vault
...
boreal glade
what
marsh vault
Whenever anyone does it, not just you
It doesn't steals your info
It bruteforces a code in the global transaction system
Used by everyone to purchase/tranfer bitcoin/other
boreal glade
ohh so it gets injected into the app and affects everyone?
boreal glade
ok so back the executable if i removed the virus how does this cryptominer relate?
safe pier
im installing nuitka and bout to see what happens
you can still get false positive AV hits with nuitka
safe pier
No, it's just that other executables created using PyInstaller have been identif...
that's one part of it, the other part of it is the way that these sort of tools need to run, first they have to unpack their contents to a directory and then do others things to run, to windows, this is a common malware tactic, extract themselves to a temporary or hidden directory from where they can persist and run, pyinstaller doens't persist, it extracts itself and its content every time
safe pier
it doesn't support python 3.12
what python 3.12 features are you using?
you can always downgrade.
boreal glade
i don't want to tho
safe pier
okay well, looks like you're confused, if your python file doesnt contain anything bad then pyinstaller will be ok
you just need to tell windows defender its safe and you want it in your system
boreal glade
you just need to tell windows defender its safe and you want it in your system
i don't think i should
i did get a virus earlier and everytime i tried to run the exe file
safe pier
i did get a virus earlier and everytime i tried to run the exe file
again, it's not a virus
it's a false positive.
boreal glade
it is?
safe pier
yes, you created the exe right?
boreal glade
yuh
safe pier
your code contains no virus right?
thats how you know it's not a virus.
this happens because python is not a language where you can create exes natively.
boreal glade
wait so pyinstaller doesn't inject malicous code?
safe pier
python is not meant to be converted to executable.
safe pier
probably because you allowed it.
boreal glade
nope
ain't got no warnings or anything it just ran it like normal
thx now ik what to do when it's time to distribute my first project for real
marsh vault
again, it's not a virus
Are you sure about it ?
I hope not, but it really looks like one
boreal glade
wait i have one more question
marsh vault
What is it ?
boreal glade
bc this kinda doesnt make sense
if i ran it multiple times earlier and the av claims it's a virus how did it not get flagged this time when i ran it
and it's the same executable and i did download this like maybe 4 to 10 times
safe pier
avs are smart.
and if you allowed the file, then it can detect that you want it
you can let viruses run as well.
safe pier
Are you sure about it ?
yes, and i'm not the only one who's said it.
again, python isn't mean to be packaged into an .exe file
the best way to distribute python code is by distributing the source.
boreal glade
avs are smart.
so did i allow it by repeadily making the executable over and over?
hazy coral
marsh vault
yes, and i'm not the only one who's said it.
Does executable that uses process known to work around AVs, and putting random .tmp files in System32 sounds legit to you ??
I know that frozen python has false positives
But it does not include this behavior afaik
And you should never, ever underestimate such cases
I did it once, and I got a trojan
Despite being warned multiple times, since I "knew what it was" I tought it was a glitch
I had to wipe everything
open flickerBOT
Python help channel closed