My antivirus deletes the CPS installer

[VK3KYY]

if it's generated by the installer itself the one can try to use a different installer (NSIS).

or just ditch M$$$$ and go linux, but CPS needs to be ported somehow. (is it opensource?)

I don't know if using NSIS would be any better. I guess I you could try it, but generally the most of the positive virus reports are basically "Susgen" i.e Suspicious Generator, i.e the EXE is not signed, and as I've previously explained multiple times; it is not practical for me to sign the exe because of the cost and also the legal obligations around owning a signing certificate and using it.

There is nothing to stop anyone taking the EXE of the installer or the EXE of the CPS and repackaging it and signing it themselves, if they pay for a signing certificate, but obviously thats not going to happen either.
i.e just take the installed files and run them through NSIS and see if that exe still gets flagged.

In one of my previous day jobs, I developed exe's which my employer distrubuted, and they had to jump through hoops to sign the EXE, including a dedicated PC used to sign the exe, which required 2 factor authentication as part of the signing process.

This is totally unworkable for a project done by a few people who get $0 for doing it.

It would not be practical to port the CPS to linux as it extensively use .NET and third party libraries outside of our control, and its also not OpenSource because we didn't write it. It was written by Radioddity and we just decompiled and modified their CPS


Edit.

I just got NSIS to generate an installer exe from the zip file and uploaded it to VirusTotal and it gets a whole load of new virus warnings

https://www.virustotal.com/gui/file/ce0 ... ?nocache=1

Uploading the zip uses to create the NSIS installer gives less warnings, i.e. which suggests that NSIS is injecting viruses

https://www.virustotal.com/gui/file-ana ... k1MTQwOA==


Uploading the exe on its own gives this report

https://www.virustotal.com/gui/file/648 ... 1196a71250


Basically this just means its an unsigned exe

[vk3vm]

This is a wider problem of Open Source vs Open Better vs Patents.

The method to overcome "patents" by extracting from manufacturer's files as used in this project is ingenious !

Patents are designed to protect against 3rd party gain from another's technology.

Yet we are Amateurs and experimenters. This is very grey area - areas that should not and must not be subject to vicious legal pursuit (that we are all aware that has happened) !

Nobody here is making money from this ! Those selling radios with OpenGD77 are also in the grey; are just re-selling hardware that they have sourced [ which in itself may have firmware on it that violates DVSI's patents ... that we do not know and may be contributing to some of these issues ].

This is an issue that needs to be taken to Politicians world-wide for sorting out ! Patent owners and holders have stepped well over the mark here by attacking the little guy, amateur and experimenter.

There are much better ways IN THAT THEY CAN WORK WITH US and GAIN THEMSELVES - Increasing their bottom lines - rather than by bullying and pursuing us !

i.e. Retaining ownership and permitting Amateur Experimentation (and the results of such experimentation) - but reserving the right to demand royalties for use of patents from anyone selling or reselling anything that uses this derived work based on their IP !

That is what we should be pursuing our lawmakers for. Everyone wins under this strategy !

[VK3KYY]

The CPS false positive has nothing to do with the IP relating to the AMBE codec.

We do not include an AMBE codec in the firmware files, or host any files containing the codec

The CPS does not include the codec.

[vk3vm]

... Hence the exact reason why this should not be detected as unfriendly by ANY ETHICAL AV.

The machine that I work with just has plain Windows 11 (Windows Defender) along with the Chrome (Not Edge) Browser in use.

--> My systems download and extract the files with no issues whatsoever.

I also employ a Ubuntu 23.10 client here ... With Chrome as the browser.

--> Again - No issues observed downloading files.

Perhaps a "more ethical" security suite needs to be chosen?

Disable the security suite - deploy - and then re-deploy the security suite ! Sometimes this is what one must do with software and packages that one knows are safe. These packages ARE SAFE.

73

Steve I
VK3VM/VK3SIR

[VK3KYY]

... Hence the exact reason why this should not be detected as unfriendly by ANY ETHICAL AV.

AntiVirus companies, always heavily bias towards false positives, so that in reviews they get better detection scores.

Generally reviews don't focus much on how bad these are at reporting false positives.

In this case, I've never heard of any of the AV companies whose products report the CPS as a virus, except Microsoft, and I've no ide why copy of Windows where the AV is totally up to date, has no problem with the CPS.

It seems a fairly limited number of people have a problem with this, considering the thousands of downloads and installs

I could make the files available as a zip with no installer, but people would then need to copy the file to some location on their machine and also run the COM driver installer, or perhaps even use the Device Manager to install the driver from the files in the zip

And the majority of people would probably find this more difficult that following the many tutorial vidoes on TY which should how to make a quarantine folder not scanned by the AV in question

[SA0BUX]

Realized that an install password may be bad as it makes it problematic to analyze the CPS package in a sandbox.

I contacted Microsoft and reported this false flag detection and missed to inform them of the password so I got a reply that they closed
the case because they couldn't test it properly.

I have re-issued it now with the password.

[VK3KYY]

Realized that an install password may be bad as it makes it problematic to analyze the CPS package in a sandbox.

I contacted Microsoft and reported this false flag detection and missed to inform them of the password so I got a reply that they closed
the case because they couldn't test it properly.

I have re-issued it now with the password.

OK. Thanks

The password was to prevent internal scanning in the CPS by Google Safe Browsing, but like you say the password now causes other problems

[YO3IDG]

It would not be practical to port the CPS to linux as it extensively use .NET and third party libraries outside of our control, and its also not OpenSource because we didn't write it. It was written by Radioddity and we just decompiled and modified their CPS

I found this codeplug writer:
https://dm3mat.darc.de/qdmr/
Source code here:
https://github.com/hmatuschek/qdmr

The program loads/runs on linux and because it is written in Qt porting should not be a huge hassle (Qt supports Windows and Mac).

However, I don't know how reliable it is in writing codeplugs.

As for binary signing, well, this is what you get when blindly paying for a single OS. The whole reason for this signing is making money, exploits are everywhere and never checked during the signing process.

[SA0BUX]

Realized that an install password may be bad as it makes it problematic to analyze the CPS package in a sandbox.

I contacted Microsoft and reported this false flag detection and missed to inform them of the password so I got a reply that they closed
the case because they couldn't test it properly.

I have re-issued it now with the password.

OK. Thanks

The password was to prevent internal scanning in the CPS by Google Safe Browsing, but like you say the password now causes other problems

The result from my file submission.

scan1.jpg (201.8 KiB) Viewed 530 times

[VK3KYY]

Realized that an install password may be bad as it makes it problematic to analyze the CPS package in a sandbox.

I contacted Microsoft and reported this false flag detection and missed to inform them of the password so I got a reply that they closed
the case because they couldn't test it properly.

I have re-issued it now with the password.

OK. Thanks

The password was to prevent internal scanning in the CPS by Google Safe Browsing, but like you say the password now causes other problems

The result from my file submission.

scan1.jpg

Thanks.

I wonder if submission to Microsoft etc is now necessary for every CPS version, even if nothing much changed.

i.e. I have 1 change pending which only renames one of the satellites in satellites.txt, but because of the build process possibly the exe will be recompiled and may be falsely flagged again.