Virus protection find malware on 1.13.0.0

[cbejl]

Windows Defender and Chrome Browser find malware in jar.

That trouble only with 1.13.0.0, the problem is not observed on the other version.

Virus Total

I fully trust you and I am sure that this is a bug that can be solved or that users can be notified about. It would also be nice to attach checksums to releases, because initially I had thoughts about a virus replacing files on my PC.

---

[HenryGX]

i have the same issues

[crykn]

This may be related to LWJGL/lwjgl3#1005.

[GuidoNicolini]

Same problem here .[Windows Defender]

[tommyettinger]

I'll see if downgrading LWJGL3 to the 3.3.3 release (which didn't flag antivirus programs) is even possible. If it isn't, we'd probably need to wait for Microsoft to figure out this isn't a virus (though the detection is most likely LWJGL3 3.3.4, and we of course use LWJGL3 heavily), or wait for LWJGL3 to push a new version that doesn't detect as malware. If it is a detection on Liftoff itself, I don't even know who we would contact to get this figured out...

[tommyettinger]

OK, I downgraded libGDX to 1.12.1 (which isn't a bad idea right now if you target GWT, Android, or really desktop too given the AV issues with 1.13.0...). This seems to essentially solve the VirusTotal issues it had; only Fortinet claims it might be a "PossibleThreat", and no other AV programs think it is a problem.

Here's a build of the latest gdx-liftoff that's had LibGDX downgraded to 1.12.1, while keeping the dependency on NFD (for file dialogs) at 3.3.4 . VirusTotal seems almost totally fine with this one.

gdx-liftoff-1.13.0.1-SNAPSHOT.jar.zip

[timoveldt]

Same as OP, but I'm also getting this warning when downloading the 1.13.0.1-SNAPSHOT posted above. So that unfortunately doesn't fix the problem 😞

[MonneratRJ]

Same issue here, ill try to downgrade it to 1.12.1... The issue happens in 1.13 @timoveldt , so i believe you need to downgrade to 1.12 instead... It has been a week, do we have any news on that?

[tommyettinger]

Downgrading to 1.12.0 is not happening. There was nearly a year of 1.12.1 being the latest version, with 18 Liftoff releases using 1.12.1, and none were flagged as malware. As far as I can tell, this seems to go back to LWJGL3 getting false positives on version 3.3.4, which weren't there before. The dep on LWJGL updated to 3.3.4 and that's used by libGDX 1.13.0, but not by 1.12.0 or 1.12.1. The weird thing is that the snapshot I posted shouldn't be using anything from LWJGL 3.3.4 except for NFD (the file dialogs part of LWJGL), and NFD 3.3.4 has been used by several Liftoff versions even before libGDX 1.13.0 was released (and none of those were flagged by AV).

If the snapshot is getting flagged, I'm not sure I have any particularly good ideas for fixing this unless I revert any version changes and bring us back to Liftoff's 1.12.1.x codebase, which could receive at least some small improvements. I think generating new projects that use libGDX 1.13.0 is probably a bad idea at this point because of the AV issue.

[TwigWallder]

I also encountered a Trojan/Virus alert here. Windows Defender flagged "Trojan
/Vigorf.A" in the file gdx-liftoff-1.13.0.0.jar. Based on what you mentioned, it appears to be just a false positive. Would it be safe to temporarily disable the antivirus to complete the installation of gdx?

[tommyettinger]

At this point I think I just want to recommend using 1.12.1.17, and see if that triggers any AV for you. Creating a 1.12.1 project seems at least safer to distribute.

[curvednebula]

The same here with 1.12.1.17.

The first version where it gives me "virus detected" is 1.12.1.16 - i.e. 1.12.1.15 - doesn't.

[tommyettinger]

This should be fixed as of the latest release, 1.13.0.1 . https://github.com/libgdx/gdx-liftoff/releases/tag/v1.13.0.1 Please let me know if there continue to be issues, but make sure you're reporting them about 1.13.0.1 , since I can't go back in time to fix 1.13.0.0 in-place.

[Trurl101]

If I don't care about Desktop variants, should i use 13.0.0 or 13.0.1?

[SonicGDX]

If I don't care about Desktop variants, should i use 13.0.0 or 13.0.1?

I think 13.0.0 might be good

[tommyettinger]

If I don't care about Desktop variants, should i use 13.0.0 or 13.0.1?

Liftoff 1.13.0.1 is a better option at this time. I don't even know if Chrome will let you download 1.13.0.0 . There are various issues in libGDX 1.13.0, affecting Android, GWT, and LWJGL3 in all different ways, and I would currently recommend avoiding that version unless you know what you are doing. There should be a patch release to libGDX at some point that fixes the AndroidX thing for Android (Liftoff does remedy this), the SpriteBatch being completely broken thing for GWT (I have a tiny fix library, but I'm not really actively recommending it), and the malware detection issue for LWJGL3 (including desktop apps you release). Liftoff 1.13.0.1 is built with libGDX 1.12.1, so it isn't affected by the malware detection issue, and while it lets you build with libGDX 1.13.0 just by changing the version when you run it, I... wouldn't change it from 1.12.1 .

[tommyettinger]

If I don't care about Desktop variants, should i use 13.0.0 or 13.0.1?

I think 13.0.0 might be good

I'm curious how you came to this conclusion. Where did the logic train jump the tracks?

By the way, 1.13.0.0 still gets flagged by AV, despite whatever actions the LWJGL3 people are taking.

I can't even download it.

Use 1.13.0.1 .

[SonicGDX]

If I don't care about Desktop variants, should i use 13.0.0 or 13.0.1?

I think 13.0.0 might be good

I'm curious how you came to this conclusion. Where did the logic train jump the tracks?

By the way, 1.13.0.0 still gets flagged by AV, despite whatever actions the LWJGL3 people are taking.

I can't even download it.

Use 1.13.0.1 .

I assumed that the only issues with that release were with lwjgl3 3.3.4 triggering antivirus for Windows builds of generated projects, but if there are others then yeah 1.13.0.1 is probably better even if not building for Desktop.

Since I mostly use Linux nowadays, it didn't occur to me that you wouldn't even be able to run liftoff 1.13.0.0 on Windows to generate the project as the app itself also uses that version of lwjgl3 haha

[tommyettinger]

It's possible we can get libGDX 1.13.0 partially working on GWT using a super-sourced library, and it's a gamble, but removing the x86 Windows DLL from LWJGL 3.3.4 might make AV software stop flagging the whole app. Android is already "fixed" by Liftoff, but it isn't the optimal scenario, and ideally a libGDX update would either depend on AndroidX reliably or not need it at all. The next version of Liftoff, since it's a desktop app, should be able to run itself on libGDX 1.13.0 and LWJGL 3.3.4 by not including the problematic x86 Windows DLL for LWJGL 3.3.4 . So far, that's passing VirusTotal scans. The problem is, the current Gradle configuration to get just that one DLL removed is... huge. I can look for simpler ways that might exist.

[SonicGDX]

Would it still work on 32bit Windows without the x86 DLL?

[Frosty-J]

Would it still work on 32bit Windows without the x86 DLL?

No, 32-bit Windows and 32-bit JREs running on 64-bit Windows can't use the x64 DLL. You'd need the x86 one if you want to support these platforms.