File detected as a Trojan by Windows Security

[aythequeenlin]

Hi. I've tried installing the latest version of Natural Voice SAPI Adapter v.0.2.9 via Microsoft Edge, but Windows Security detected the .zip file as a severe threat (e.g. Trojan) and blocked it. See the attached picture, please. Are these files really safe to download and install? Also, thanks for this great tool you've created.

[papicy]

Happens to me aswell

[gexgd0419]

What about using a release version earlier than v0.2.8, such as v0.2.7? Is that version also detected?

[reruem]

0.2.8 also says virus detected. 0.2.7 works fine though with no virus warning.

[aythequeenlin]

Hi, @gexgd0419. Sorry, I've totally missed the reply-notifications on GitHub.

Yes, it's the same for me; the version 0.2.7 works fine without any issues. That's why I had to use that version again after reinstalling Windows on my laptop.

[ReneDussault]

same problem here. im guessing false positive?

https://www.virustotal.com/gui/file/7129d8675925e5a141addd820ce55b2ea4af0708c901e3a3e8e225e1ce15b4ce/details

[ReneDussault]

#67 #87 #94

[KaRniZZZ]

If you look at the diffs between versions 0.2.7, 0.2.8, and 0.2.9, the only thing that could have triggered these detections is the update of the open-source YY-Thunks library from 1.1.1 to 1.1.9. This library provides backward compatibility for older Windows versions, so it is heavily packed with low-level calls that are structurally similar to the techniques used by malware. Therefore, I am absolutely sure these are false positives.

[gartkb]

this is a thing nowadays to steal keys to publish bad libraries that then get incorporated into projects and on to users
so assuming that library is clean isn't exactly a safe assumption just on first principles. I have no idea whether this is an actual issue or not. but there has been high profile examples of this sort of thing happening.

[maxoptimus]

bitdefender too; is because setup use regserv for dll maybe...

[gexgd0419]

v0.2.7 already does all those "dangerous" things, but it hasn't been detected as a virus. Weird.

Maybe next time I should try separating out the YY-Thunks part (for older Windows compatibility), so users with a recent version of Windows can choose a version without YY-Thunks, which could be less likely detected as a virus.

Neither Microsoft nor I has recommended that you use this tool inside your own project or in production environment. Use it at your own risk.