vimrun.exe in gvim_9.1.0949_x64_signed.zip is reported to contain Trojan:Win64/Cobaltstrike!MTB

[Konstantin-Glukhov]

Steps to reproduce

On Windows 11 use Edge to download gvim_9.1.0949_x64_signed.zip. Download will fail with message about the virus.

Expected behaviour

No viruses

Version of Vim

Vim 9.1.0949_x64

Environment

Windows 11 with Virus & Threat Protection on.

[chrisbra]

Please check previous tickets or the FAQ

[Konstantin-Glukhov]

This is not a duplicate. There is a real threat in this file.

[k-takata]

Please report it to the anti-virus vendor as a false positive.

[chrisbra]

There is a real threat in this file.

So then please clarify. I ever only hear about "flagged" as trojan, but nobody has ever proven that claim.

[Konstantin-Glukhov]

How to prove there is a virus in a file.
Download the archive gvim_9.1.0949_x64_signed.zip into a directory that is exempt from live virus scanning.
Extract vimrun.exe from the archive.
Make a copy of vimrun.exe, e.g. cp vimrun.exe myFile
Copy myFile to a directory which is part of a live protection or scan myFile with antivirus, the virus will be detected.
(By renaming/copying the file you eliminate the "name check", and make antivirus to look inside the file)

Repeat the same procedure with gvim_9.1.0902_x64_signed.zip.
There is no virus in vimrun.exe in this version.

[chrisbra]

How to prove there is a virus in a file.

Well, you are the one claiming this is a real threat here, so you need to be a bit more specific. This is an open-source repository, so you can see exactly what

• has been compiled and
• how it is build

So you should be able to verify if something fishy is happening by going through the build logs and/or have your Anti-Virus point you to the exact line where "the virus" exists. Oh it doesn't tell you? Well, go figure....

Note: vimrun.c hasn't been changed in years and your not obliged to be using this repository, you can compile your own version if you really want to. Or you use an older version that hasn't been flagged (even so the vimrun.exe source file has been the same for the last 5 years!).

We are providing those daily builds as a service for all Vim users for free and we are spending our precious time maintaining all of this, which you can trust me, costs me every day at a minimum 2 hours.

I can think of better way to spend my time than on dubious false positive anti-virus reports.