ldc2-1.22.0-windows-multilib.7z: Trojan detection for libcurl.dll

[andre2007]

This is to make you aware McAfee Endpoint Security reports in archive ldc2-1.22.0-windows-multilib.7z a trojan RDN/Generic.dx in lib/libcurl.dll and lib64/libcurl.dll.

[kinke]

Thanks, that's at least a bit more info than in #3448. The VirusTotal results are here (retriggered, McAfee didn't detect anything when the file was firstly scanned about a month ago IIRC): https://www.virustotal.com/gui/file/5b965af2d2df7f290addb855a4f8a8da06849104d04045b83756b231af81f029/detection

That DLL has been built on my box.

[kinke]

I've temporarily enabled Windows defender to scan the file (+ a quick scan for my system), no hits (although VirusTotal reports 'Microsoft' complaining).

Anyway, it's exactly the same file bundled with v1.21. The 32-bit version was also built on my box using the same official source some seconds after building the 64-bit version. So as far as I can tell, just another false positive.

[wilzbach]

FYI: DMD had a lot of these messages in the past as well.
Since dmd binaries (and libraries) were signed with a Windows CodeSign certificate, most of them seem to have gone away.

I'm sure the DLF would be okay with sharing access to the certificate (VisualD uses it too). Though, it's quite a pain to work with as it's not easy to integrate into CIs and Martin Nowak had fun times integrating it in the D release pipeline (see e.g. dlang/installer#339).

[JudgeFish]

Interestingly there seems to be no positives on virustotal for the libcurl.dlls provided with DMD (32 or 64-bit version) but about 23/67 positives for the versions (32 and 64-bit) provided with LDC.
This is on the now latest "VisualD-v1.0.1-dmd-2.093.1-ldc2-1.23.0.exe"

None of the four dlls are signed.

Maybe the solution is to use the builds or build settings from DMD .

[rainers]

@kinke AFAICT the libcurl.dll files are prebuilt and don't change too often. Would it be feasible to sign them manually (I could do that as part of bundling them with Visual D) and put these into the releases?

[kinke]

To be perfectly honest, I hate having to deal with workarounds for crappy anti-virus stuff, unless someone can actually show I've indeed been spreading malware via one of the last few artifacts built on my personal box. If anyone wants to try to reproduce, the steps are listed in #3378.

If the upstream builds work fine, I guess we could simply reuse them; IIRC, you're using a MinGW toolchain, while I'm using MSVC plus making sure it can be linked statically (incl. linking fine with the MinGW-based libs, and no MSVCRT dependencies for the DLL...).

[andre2007]

McAfee Endpoint Security is fine with ldc2-1.24.0-beta1-windows-multilib.7z. This is huge news because it blocked me from updating to newer LDC release.
Hopefully it is still fine with the official 1.24 release :)

Thank you.

[kinke]

Great - the libcurl.dll files are exactly the same as bundled since v1.21... ;)

[andre2007]

@kinke
You are right. McAfee Endpoint Security is also fine now with older LDC versions => The scanner was adapted to longer detect false positive in libcurl.dll.

Thanks.

[rainers]

I'm now also troubled by Windows Defender removing libcurl.dll while building the Visual D installer that bundles LDC. This seems to have started within the last couple of days.
Is it ok to just replace them in the Visual D installer with the DLLs distributed with dmd? These are not digitally signed,but have other DLL dependencies.

[andre2007]

The issue is also occurring for me again. In the meantime I also send a sample to McAfee for further investigations but never received an answer.

[kinke]

Is it ok to just replace them in the Visual D installer with the DLLs distributed with dmd?

I guess so, but I would obviously prefer my libs if given a choice. ;)

[kinke]

@rainers: The new libs linked above don't seem to have these issues. https://github.com/ldc-developers/mingw-w64-libs/releases/download/v8.0.0/libcurl-7.74.0-zlib-static-ipv6-sspi-schannel.7z

[rainers]

Thanks @kinke. No problems anymore when adding these files to LDC 1.24 and building the bundling installer.

[andre2007]

Yes, McAfee is fine with curl dll files from 1.25.0 beta1.

Thank you!