Cameyo

Yes, recently antivirus started reporting Cameyo and Cameyo-built apps as infected, for some reason. We've already contacted Symantec and reported the false alarm, which they accepted and fixed.

We're calling for Cameyo users to please report the false alarm to their anti virus companies (and don't worry, their experts do all the work to check that this is NOT a virus but a false alarm). This is where we need you guys' help...

 

Have you had a chance to build another pacakge to test for the problem?

Is Online Packager working for you now?

I tried Extension Changer and RobotProg.

Here are virustotal results for Extension Changer installer.  At 1/46, we can assume it's a false positive.  I built with Cameyo-2.0.832 like yours; it can be downloaded here, and these are virustotal results.  At 1/46, again I think we can assume it's a false positive.

Here are virustotal results for RobotProg installer.  At 4/47, I would like to give the benefit of the doubt and think that the four flags are overzealous.  I built with Cameyo-2.0.829 like yours; it can be downloaded here and these are virustotal results.  At 2/46, I think it is probably okay.

Downloads of your packages of Extension Changer and RobotProg gave different virustotal results (20/46 for Extension Changer and 8/46 for RobotProg), which makes me think the machine in which the packages were built was possibly already infected. 

Sorry,
but here is still a problem:
these are my package that have been made recently.
Today my AVG anti-virus told me to remove all the application
But after I upload them to VirusTotal, the result is that only AVG said that the packages are infected.
Example here:
1. Greenshot 1.1.1.2550RC1: https://www.virustotal.com/en/file/a49209e4427aeb0d8cd73d8e2eb9c6b0cf295eaf165150a8961faf568349e984/analysis/1366629793/

2. A Note: https://www.virustotal.com/en/file/84bf231ed7b6d1315f57b9670143f45374aa920d5673f292abe570e0cb8db617/analysis/1366630070/

3. I even uploaded my Cameyo 2.0.873: https://www.virustotal.com/en/file/e7db62003dc3276904abfd066d2886656f6ab3a755f5864367c580ad2d668991/analysis/1366630236/
Do I get the right one? I remember that I downloaded the package at the official site. Is its SHA256 code e7db62003dc3276904abfd066d2886656f6ab3a755f5864367c580ad2d668991?

4. Even VirusTotal uploader
https://www.virustotal.com/en/file/76e7f41c5248d2bd87dbc1961e2bc7dbd12a7cab3628d4c97e99e257e038667b/analysis/1366630463/



Does anyone have a package that AVG will treat it as virus? Please post the result here. Thanks.

This is what I got after scanning Torch browser made portable with Cameyo v2.0.882:


https://www.virustotal.com/ru/file/6d1b6840f8bc80e5de81b412ab772af4f6ecbd5ef549dbcc1aae8ca69711cb8c/analysis/1368463180/


The issue came up on a computer running Avast Free Antivirus. I contacted their technicul support people and here's what they had to say abou it:


Hello,

Thank you for contacting AVAST Software company with your concerns.

Files are encrypted and unfortunately they use similar code as other viral samples. Best recommended is put those in exclusions.


Miroslav Jenšík
AVAST Software a.s.

And here's my reply:

 

Hi,

I'd like to once again draw your attention to the fact that I have no administrator privileges on my PC. Therefore, adding the file to the exclusion list is not an option since my AV settings are password-protected. You had the chance to see that the file isn't infected with any malware and poses no danger whatsoever. The reason why Avast identifies it as a threat is because it fails to scan the encrypted sections of the code, not because the code resembles malware. Here, take a look at what other major AV brands, such as Kaspersky, McAfee, NOD, and DrWeb, had to say about this:

https://www.virustotal.com/ru/file/6d1b6840f8bc80e5de81b412ab772af4f6ecbd5ef549dbcc1aae8ca69711cb8c/analysis/1368463180/

They have been in this business long enough to tell a real threat from a non-existent one, haven't they?

Please, show this to your programmers and have them do something about the virus definitions.

 

Judging from their reply, they're not going to do anything about it...

 

@mule

I would be interested in seeing your package to see what files your package has that mine does not have.

Sure, no problem:

http://www68.zippyshare.com/v/94028418/file.html

I packaged Torch, deleted the Installer and Profile directories so that it would be small enough to fit within virustotal's size limit, and received these results. My package can be downloaded here.

Hmm... Interesting... I don't even know what to say... I re-submitted the file but virustotal came up with the same results:

https://www.virustotal.com/en/file/6d1b6840f8bc80e5de81b412ab772af4f6ecbd5ef549dbcc1aae8ca69711cb8c/analysis/

perhaps your package captured activity that resulted in encrypted files being contained therein

No chance. I captured both snapshots on a pristine clean copy of w7 installed within Virtualbox. So no encrypted files could have ended up inside the packaged app. My guess is, there are no 'encrypted files' but for the ones inside the Avast people's heads. They can't be bothered 'cause it'll will take messing around with the virus definitions, which none of them wants.

Maybe my virustotal results differ from yours because the antivirus updates may have been slightly later.

That's a possibility.

-- Edited by chupacabras on Wednesday 15th of May 2013 02:01:48 PM

-- Edited by chupacabras on Wednesday 15th of May 2013 02:39:47 PM

My loader's SHA1 code is 21d435110b43be297c96e5e3b266a12fd1d89ef4.
I changed the loader of some of my application. I choose ScreenSharp as an example. Before changing, the result is here (20)

https://www.virustotal.com/en/file/54dd042d894908a700a4d539409ad07ba173789535a809392c77bac801517f3f/analysis/1368703174/

and after changed,

https://www.virustotal.com/en/file/230c754f3dc382cabbd85389333d23fc46c3095268e933254df30c9305a7eb0d/analysis/1368703324/
,which is consider as a false alarm, although I am using AVG now...

However, the package cannot be started after I change the loader.

Here is my package:

http://www.mediafire.com/?vf4r5iiacvkzzfl

And it will really be a disaster if I have to change the loader of all of my application. I will figure it out later...

-- Edited by tony200910041 on Thursday 16th of May 2013 04:36:15 AM

@mule

Trying to download your package resulted in the download session being aborted for security reasons ))) I got a red-hot pop-up alert from Avast notifying me that the file is infected with a trojan. So, I don't think changing a loader would make much of a diffrence in my case....

I think it's the compression algorythm used by Cameyo that causes all output packages to be falsely identified as malware.

 

-- Edited by chupacabras on Friday 17th of May 2013 03:42:58 AM

-- Edited by chupacabras on Friday 17th of May 2013 03:44:18 AM

OK. So here is my loader and my package:
http://www.mediafire.com/?5ncqqercbv6a58c

And ScreenSharp:
http://www.mediafire.com/?b0fue0fkw81s0mu

Tony200910041, the Loader.exe you uploaded is from the current build of Cameyo (2.0.882).  The one I was seeking was the one that was used to build ScreenSharp originally, which appears to have come from Cameyo-2.0.873.  If it's easier to upload your Cameyo-2.0.873 instead of Loader.exe from Cameyo-2.0.873, that will work for me.

Also, how did you change the Loader to get the package that wouldn't launch?  When I apply -ChangeLoader to your original package, it still launches, and yes, the virustotal results reduce substantially.

Tony,
We'll still need to look at your Loader.exe, not just the Cameyo-2.0.873.exe (the Loader.exe could have been replaced / infected, for example). Any chance?

@cameyoco

So, what about my case? Have you tried installing Avast on Virtualbox or VMware Workstation and running apps packaged with Cameyo? I suggest you do because that way you'll see that playing around with loaders is no solution at all. I couldn't even save the ostensibly 'clean' Torch browser made by mule due to the virus alert brought up by Avast.

 

Update: Hmm... I tried downloading mule's package again and it all went off without a hitch this time. But mine is still detected as a threat ((( Avast seems to be blowing cold and hot on this one...

-- Edited by chupacabras on Monday 20th of May 2013 04:03:21 AM

Sorry,
but today the situation is deteriorating. After a Windows update of .NET Framework 1.0, Cameyo failed to start. The welcome screen appears for about 1 second, and then crashed. Now I think it is time for me to stop working for portable application and fix my computer, at least turn off the Windows update.

By the way, the Loader.exe cannot be found. Better to extract it from those Cameyo package.

Avast is much better than AVG...

(update) And also finish fixing the issue. I uninstall all .NET Framework version and then install them again. Cameyo starts now.

However, I really think that it is better to package an application by Online Packager. It is more stable and the result is better -- the package won't be treated at infected. Let's try it.

-- Edited by tony200910041 on Tuesday 21st of May 2013 08:38:43 PM