# \[False positive\] Malware in the installer **URL:** \ **Category:** Support\ **Tags:** false-positive, virustotal\ **Created:** [May 16, 2024, 4:55pm UTC](https://forums.synfig.org/t/false-positive-malware-in-the-installer/15061 "2024-05-16T16:55:09Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Herman435](https://forums.synfig.org/letter_avatar_proxy/v4/letter/h/c0e974/32.png) [@Herman435](https://forums.synfig.org/u/Herman435)\ **Post date:** [May 16, 2024, 4:55pm UTC](https://forums.synfig.org/t/false-positive-malware-in-the-installer/15061/1 "2024-05-16T16:55:09Z")
**Título** : Posible Malware Detected in the Synfig Studio Installer ![NoVirus1](https://forums.synfig.org/uploads/default/original/2X/7/7030a818f99f31c1f27a4a986d1a6e026d7a40b1.jpeg) **Descripción** : Hi Synfig team I wanted to inform that when i wanted to download the last version of Synfig Studio from the official page, my antivirus software detected a troyan malware, i checked it with a webpage named virus total and said it too - **Operative System** : Windows - **How did I installed it** : 1 I entrered the official page [https://www.synfig.org/](https://www.synfig.org/) 2. I clicked the download stable version button 3. I downloaded the installer from the anonimus link, i downloaded the Windows 64 bit Installer, and when i tried from the other way, by giving my email, it didnt work, i got the synfig studio but it didnt download nothing Please fix it, and excuse me by my english, i speak another language, and i dont speak english very well I would like if you could speak it with the opentoolz team, because i did see it t Thanks ---
**Author:** ![BobSynfig](https://forums.synfig.org/user_avatar/forums.synfig.org/bobsynfig/32/175_2.png) [@BobSynfig](https://forums.synfig.org/u/BobSynfig)\ **Post date:** [May 17, 2024, 10:21pm UTC](https://forums.synfig.org/t/false-positive-malware-in-the-installer/15061/2 "2024-05-17T22:21:05Z")
Hi and welcome here > > > \*\*Synfig version & platform\*\*: 1.2.2 Win64 > > \*\*Issue description\*\*: virustotal.…com -\> trojan detected at Win64 1.2.2 build > > Download from https://downloads.synfig.org/stable/SynfigStudio-1.2.2-18.09.14-win64-286f1.exe -\>Ikarus + Trapmine = https://www.virustotal.com/gui/file/8976eecc273e3c22c299c0a7c4aced53a1e032acb67b76479cccfd2e472c8515/detection > [@\[Solved\] A error message with antivirus and synfig 0.64](https://forums.synfig.org/t/solved-a-error-message-with-antivirus-and-synfig-0-64/2606): > > Hello, I have just downloaded the version Windows 0.64 of synfig on the official site. During the installation I have a error message of my antivirus which quarantines the libgdk file. I want to know why and if it’s risked to use synfig with this version? Thank you. EDIT: False positive, no virus. > [@Sophos antivirus complains and quarantines](https://forums.synfig.org/t/sophos-antivirus-complains-and-quarantines/14020): > > I have just installed Synfig (SynfigStudio-1.4.4-2023.03.30-win64-b8d62.exe) and along the way, my local Sophos antivirus software warned me that it did not trust the following files and so quarantined them… Potentially unwanted application detected These applications are not malicious but has potentially unwanted behaviour, and will be quarantined… Generic ML PUA: C:\Program Files\Synfig\bin\gspawn-win64-helper.exe Generic ML PUA: C:\Program Files\Synfig\bin\gspawn-win64-helper-console.exe … ---
**Author:** ![Ar\_D](https://forums.synfig.org/user_avatar/forums.synfig.org/ar_d/32/7751_2.png) [@Ar\_D](https://forums.synfig.org/u/Ar_D)\ **Post date:** [May 18, 2024, 7:40am UTC](https://forums.synfig.org/t/false-positive-malware-in-the-installer/15061/3 "2024-05-18T07:40:27Z")
Well, I don’t know why people use antivirus software these days. It was understandable back then. You get the best protection with windows defender now. Plus a pro thing, you don’t have to shell a penny outta yo pocket except the windows key, you can even activate windows with free alternative methods if you understand me 😉 I don’t really recommend to use alternative methods 🙂 And it understands what really has malware 😉 ---
**Author:** ![BobSynfig](https://forums.synfig.org/user_avatar/forums.synfig.org/bobsynfig/32/175_2.png) [@BobSynfig](https://forums.synfig.org/u/BobSynfig)\ **Post date:** [May 18, 2024, 8:47am UTC](https://forums.synfig.org/t/false-positive-malware-in-the-installer/15061/4 "2024-05-18T08:47:41Z")
Sometimes, Windows Defender is not enough, sufficient for most “base” users. Depending the usage done, in enterprise, using warez, or anything where a new breed of malware is appearing, then an AV is required. For Windows users mostly, of course, Mac and Linux have other means of protection (while not 100% perfect). ---
**Author:** ![Ar\_D](https://forums.synfig.org/user_avatar/forums.synfig.org/ar_d/32/7751_2.png) [@Ar\_D](https://forums.synfig.org/u/Ar_D)\ **Post date:** [May 19, 2024, 3:53am UTC](https://forums.synfig.org/t/false-positive-malware-in-the-installer/15061/5 "2024-05-19T03:53:06Z")
> [@BobSynfig](#): > > then an AV is required Yeah I understand about that use case. I am just telling that for someone who is a home user, and who doesn’t really play with a lot of dark web stuff, but is still geeky. Windows defender is all they need, paying for avast, quickheal, McAfee at that point is basically useless. Anything above that, then they obviously should use a good antivirus. ---
**Author:** ![BobSynfig](https://forums.synfig.org/user_avatar/forums.synfig.org/bobsynfig/32/175_2.png) [@BobSynfig](https://forums.synfig.org/u/BobSynfig)\ **Post date:** [May 20, 2024, 12:54pm UTC](https://forums.synfig.org/t/false-positive-malware-in-the-installer/15061/6 "2024-05-20T12:54:47Z")
A “Home User” can be a grand-mother or a child. Most of the victims of malware are “digitally uneducated” vulnerable people, and even “experts” can sometimes fall into traps like 0-day. Clicking on a link in an email, installing a toolbar/codec which promises to have the possibility to watch the last blockbuster or to obtain discount on online orders or some coupons. Downloading a software from the first link found on Google, which is not necessarily the original version … Even AV free versions can save most of unexpected threats. 99% of the time, the malware has been installed with the consent of the user. Also you don’t need to go on the dark web to be fooled. Maybe you are a bit you to have seen exploits via “harmless” images in web browser, but they existed (EMF/WMF, SVG, PNG …). To summarize, you don’t need an antivirus under Windows if you are not connected to the internet and don’t plug any device on your computer … And still there are ways to get infected 😛 > **[Windows Metafile vulnerability](https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability)** > > The Windows Metafile vulnerability—also called the Metafile Image Code Execution and abbreviated MICE—is a security vulnerability in the way some versions of the Microsoft Windows operating system handled images in the Windows Metafile format. It permits arbitrary code to be executed on affected computers without the permission of their users. It was discovered on December 27, 2005, and the first reports of affected computers were announced within 24 hours. Microsoft released a high-priority upd... > **[SVG Files Abused in Emerging Campaigns | Cofense](https://cofense.com/blog/svg-files-abused-in-emerging-campaigns/)** > > Learn how threat actors are exploiting the use of SVG files for malware delivery and how to protect your organization from these emerging campaigns. [https://oit.utk.edu/security/learning-library/article-archive/protecting-against-malware-concealed-in-png-images/](https://oit.utk.edu/security/learning-library/article-archive/protecting-against-malware-concealed-in-png-images/) ---
**Author:** ![Ar\_D](https://forums.synfig.org/user_avatar/forums.synfig.org/ar_d/32/7751_2.png) [@Ar\_D](https://forums.synfig.org/u/Ar_D)\ **Post date:** [May 20, 2024, 2:19pm UTC](https://forums.synfig.org/t/false-positive-malware-in-the-installer/15061/7 "2024-05-20T14:19:35Z")
Well… What proclamation might I utter henceforth? Thou hast verily smote me with thy veritable deluge of “KnOwLeDGe ✨✨”. Mayhaps I can only proffer mine apologies and tender my salutations, for I do accept mine ignominious defeat 💀 ---
**Author:** ![BobSynfig](https://forums.synfig.org/user_avatar/forums.synfig.org/bobsynfig/32/175_2.png) [@BobSynfig](https://forums.synfig.org/u/BobSynfig)\ **Post date:** [May 20, 2024, 3:29pm UTC](https://forums.synfig.org/t/false-positive-malware-in-the-installer/15061/8 "2024-05-20T15:29:38Z")
When you will be my age, you will have seen so many “horrors” that you will never trust blindly marketing affirmations like “totally safe”. Even for simple Windows updates, there are series of tests before to deploy them in production Trust no One, Mr Mulder ![CigSmokMan](https://forums.synfig.org/uploads/default/original/2X/0/01c550b7fe76eb054f1950918ce8d45d28f20fe5.jpeg) ---
**Author:** ![BobSynfig](https://forums.synfig.org/user_avatar/forums.synfig.org/bobsynfig/32/175_2.png) [@BobSynfig](https://forums.synfig.org/u/BobSynfig)\ **Post date:** [May 5, 2025, 9:40am UTC](https://forums.synfig.org/t/false-positive-malware-in-the-installer/15061/9 "2025-05-05T09:40:19Z")
See this for more details and explanations : > > > Hi! I am interested in getting into animating, and your software looked great! H…owever I had a problem with a virus total scan. I checked out a previous github posts on a similar topic and by now I am fairly convinced they are false positives. However I'm not 100% sure and just wanted to see if you could get this fixed. > > Sorry to bother you. > > https://www.virustotal.com/gui/file/90f450cc5ee4180070ea0362a2c072907e5762872df131c550474369134a1fb9/community > > Oh, I forgot to mention I downloaded anonymously so it should be the latest version and official. ---
**Author:** ![BobSynfig](https://forums.synfig.org/user_avatar/forums.synfig.org/bobsynfig/32/175_2.png) [@BobSynfig](https://forums.synfig.org/u/BobSynfig)\ **Post date:** [May 5, 2025, 9:40am UTC](https://forums.synfig.org/t/false-positive-malware-in-the-installer/15061/10 "2025-05-05T09:40:22Z")
Closed on May 5, 2025, 9:40am UTC