Crystal programs trigger virus warning

Help & Support
1

I received an email from a person representing a website that makes available download links to foss, the kind of place that has reviews and that sort of stuff. Apparently, a util I’d made that’s currently available on Sourceforge triggered virus hits on the website “Virus Total” (https://www.virustotal.com) which they use to screen software.

Baffled, I tried it myself, and it did indeed trigger hits, though there’s absolutely nothing wrong with the util. Testing, I compiled print("hello world"), and it also triggered virus hits on that website. Are there any known issues with regard to this topic? My own computer is clean afaik, the company runs ESET end point (yes I’m using a company computer) and I’ve never had issues.

2

In my limited experience, executable files created with Crystal are often falsely detected as viruses on Windows.

I use a GitHub Action to compile a Crystal program for Windows and publish it to a release. When I download it and try to run it, my faithful McAfee immediately removes the file as a virus. Thanks McAfee…

3

Yes. The issue are services like Virus Total and other anti-virus software. Their detection “success” is flaky at best and full of false positives.

3 Likes
4

I guess the word “services” should be kept in quotes. The Virus Total website gave almost no information, just said “malicious”.

5

I believe downloading compiled executables irrespective of tool/language and without code sign are easy victim of those anti-virus tools.

Even the OS itself prohibits internet downloaded executable until unless they are signed using certificate issues by OS Vendors like M$ and Apple

7

Lots of dev tools ping AV unfortunately, just kind of the name of the game. AV companies need to whitelist Crystal like they do Python but its not nearly as popular. Just another reason to keep a linux box around for dev testing I guess.

8

Actually, the util in question was made and compiled on Debian, and I put it into Thunar’s context menu. I thought it would be handy for Windows’ users, so I compiled a Windows version in a VM and made an installer for it, since there’s a separate util to make the registry edits to put it into Windows file explorer context menu. One of the things that made me laugh was that the program that displays a pop up box (written in TCL/TK and starkit wrapped) after the Crystal engine does its thing also got flagged by … Crowdstrike Falcon!

1 Like