7

But Its a lie

I am facing this issue with my installer: Installer exe when downloaded from the websites in Chrome are flagged as being malicious software.

To overcome this problem so far we have tried changing domain names,but its not a permanent solution.

enter image description here

Even after signing my exe with Thawte certificate the flag is still there.

I have scanned my exe with all popular AVs and there is nothing malicious in it.

How can I get rid of this chrome flag?

Community
  • 1
  • 1
foobar
  • 2,887
  • 2
  • 30
  • 55
  • It may be flagging based on the compiler you used. I know that autoit executables get blacklisted by Google chrome when hosted on a website that isn't "trusted". I don't know much more than that though. – Radley Sustaire Jan 20 '14 at 10:48
  • The cake is never a lie! Sorry... couldn't help myself. Not really sure this is a programming question... have Google'd that message? – robnick Jan 20 '14 at 10:49
  • @RadGH The installer is NSIS based. – foobar Jan 20 '14 at 10:59
  • Were you able to get anywhere with this @smilepleeeaz? – strider Mar 24 '14 at 21:15

3 Answers3

2

The webmaster site doesn't do anything to help with the false positive on installers. All it does is tell you the file is potentially malware without giving you any way of appealing or asking for a review of their findings. With FireFox and Chrome and others using this data, you would think Google would provide a way to appeal. It is ironic the company starting the false positive initiative with Microsoft is the worst offender in creating false positives.

Bret
  • 21
  • 2
0

You may be able to get around the issue by supplying your site's URL to "Google Webmaster Tools". You don't even have to supply a URL for every single "malicious" file; an overall, top-level URL for your site (or, for your little corner of Blogger.com) seems to be adequate.

If you've got a Google account, just log in and go to this URL. There's a prominent textbox with an "Add Site" button next to it that does the trick. This worked for me, in a matter of minutes (and I don't have a "certificate", other than the one I got for winning a raft race in Pre-K).

Oh, and I too have experience working in heuristics, as part of my degree. "Heuristics" are really just what ordinary, unpretentious people call "rules of thumb"!

user1172763
  • 296
  • 1
  • 4
  • 17
  • Adding the site to Webmaster's Tools without any warnings or compliants doesn't help. – tim Nov 29 '14 at 01:03
  • @tim, I'm just sharing what worked for me. Others may require (or simply prefer) additional hand-waving and mumbo-jumbo. – user1172763 Dec 16 '14 at 19:31
-1

It may be that Chrome is using heuristic analysis, to determine that this file is "malicious". That is to say, it is basically saying "Because this file possesses these qualities, we therefore believe this file to be malicious".

Given that a few years ago, someone got hold of a root certificate authority, and proceeded to make genuine security certificates (so that people wouldn't be suspicious, and because they were actually genuine, browsers did not notify the user), for their sites which asked for personal data (bank username and password, etc), and stole it, until that authority was annulled a few days later.

Therefore, simply having an .exe with a certificate (a genuine one, which of course, you have), won't suffice, in Chrome's mind, for the above two reasons.

I'm sorry I can't tell you how to get rid (or at least alleviate somewhat) this issue, but I thought it'd be helpful for you to have some possible reasons as to why this is occurring.

**EDIT: Sources to back up my claims: http://news.techworld.com/security/3266817/online-fraudsters-issue-fake-security-certificates-for-google-yahoo/

http://www.bbc.co.uk/news/technology-14819257**

I also have experience working in heuristics, as part of my programming degree.

Paul
  • 95
  • 2
  • 12
  • This answer looks like speculation, do you have any sources to back up your statements? – Rob W Jan 20 '14 at 11:01
  • Ah yes, sorry, about that. They're in the question now. I should also note that I have experience in working with heuristics, given that I have taken university courses in them, and hold a programming degree. – Paul Jan 20 '14 at 11:23
  • I have no doubt that incidents occurred where CAs were compromised or RAs did not perform their tasks. And it indeed seems logical to infer that certificates cannot be used as a free ticket to bypass all security. However, I still don't see anything that supports your claim that Chrome fully ignores certificates. And while it's conceivable that Chrome uses heuristics, I would like to see a link to an official source (e.g. Chromium source code) that confirms such assertions. When I searched for the technical details of the implementation, all I found were news articles that praised the update.. – Rob W Jan 20 '14 at 11:32