Virus warning on Windows Defender and Virus Totals

[GoNINzo]

Got a report from one of my users that pyfa is triggering windows defender.

https://www.virustotal.com/gui/file/202ddf64a7defb7d78bcc15783601876655134c29baecafe7d2ec773298bbb26/behavior

I'm seeing a lot of dropper files, so I don't know if someone injected some code that was obsfuscated. Including a services.exe process that got suspended for injection.

[DarkFenX]

Pyinstaller apps (the thing I am using to bundle pyfa into an executable) are often flagged as malware/trojan.

When I make a new release and uploaded it to virustotal, no flags are raised. When release is getting installed on more user workstations, it starts getting flagged (since it spreads, much like a "virus" does). Once it happens, I have to submit the release for whitelisting into MS.

At some point, defender seemed to stopped flagging pyfa. I guess I have to start doing it again, starting from release I am building atm.

[sovurome67]

pyfa_patch_v2.zip
Man, that defender flag is a total pain. I ran into the same weird injection behavior with the services.exe process last week. It turns out it was just a bad signature in the wrapper causing the false positive dropper alerts. I attached the patched binary that clears the heuristic hit.

[DarkFenX]

The link posted originally shows clear results btw, after someone rescanned the executable.

As a note, I would advise not to run executables uploaded by other users, unless you trust them.

@sovurome67 if you explain to me how to fix it (and I can make it part of build process), I might be able to apply it to today's release, or later releases.