virustotal reports trojan

[harald-dunkel]

Current msi file version 1.12.2 linked from https://rancherdesktop.io/ contains the file Icon.RancherDesktopIcon.exe with the hash A896BCD5DB02C9BD68B4BCBF81187E7571314110F2D8C3B6A362452B9068592E
virustotal has 11 vendors saying this ist a trojan / malicious / unsafe.
Can anyone else confirm this?

[mook-as]

Relevant VirusTotal link: a896bcd5 — that is indeed Icon.RancherDesktopIcon.exe referenced by Rancher.Desktop.Setup.1.12.2.msi.

Of course, that file does literally nothing; it's just there to provide an icon for the installer (because we previously used the main application executable for this, which was 150MB, and pointlessly bloated our installer). Perhaps they don't like the fact that it does too little? For the next time, I can try to make it do something (or add an icon to rdctl.exe) instead?

[harald-dunkel]

Thank you for your answer.
The linked file with the source code looks so tiny.
The Icon.RancherDesktopIcon.exe from the .msi file has 853 kByte

[harald-dunkel]

this is the file from 1.12.3:
https://www.virustotal.com/gui/file/3cebc3608782a0b054a363b1fdb72aa0caf5058a2ac78f5ba6165fe69eadb836
it's getting worse

[harald-dunkel]

Is there any way of proving that the 12 AV vendors are wrong? Because with the CVEs that are fixed in 1.12.3, I can't let the developers continue working with the old versions. But I can't allow them to update to the new version either, because it potentially contains malicious code.

[jandubois]

You will have to take this up with the various AV vendors. The results seem bogus to me. I just cross-compiled an empty Go program on macOS for Windows and uploaded it to VT, and it shows 8 hits:

$ cat main.go
package main;
func main() { }
$ GOOS=windows go build main.go

Then upload main.exe to VT and see this: https://www.virustotal.com/gui/file/98e8aed0863706e61b4ad9b455a7bf6eef46c755cbe8245b4448dfa3c9929525/detection

I am surprised that they claim both "Google" and "Microsoft" detect something there, but the only way this can have a virus/trojan would be if the Go runtime as released by Google itself has a virus, which seems unlikely.

Note that the Icon.RancherDesktopIcon.exe file was compiled on a Windows Github runner, and I compiled the empty file on a macOS system using cross-compilation. There is no shared software involved, except that both machines of course have the Go compiler and runtimes installed.

Occam's razor says the AV program results are bogus.

[jandubois]

Just throwing a couple links in here from a quick Google search:

https://go.dev/doc/faq#virus
https://www.reddit.com/r/golang/comments/10exyob/empty_func_main_is_detected_varius_virus_windows/
https://betterprogramming.pub/a-big-problem-in-go-that-no-one-talks-about-328cc3e71378

There are plenty more; maybe they will provide you with some peace of mind?

[harald-dunkel]

AV scanners do not recognize Occam's razor.
But they move files to quarantine.

[mook-as]

#6430 filed to pick a (much larger!) executable, in the hopes that they will be satisfied by it actually doing something.

[harald-dunkel]

Thank you very much!