Reduce antivirus / SmartScreen false-positive surface#1
Open
Sutaigne wants to merge 6 commits into
Open
Conversation
Closes Issue 2 from the v4.1.5 field test ("old UI rendered"). The
v3.x cream/serif visual companion is replaced with a parity port of
python/src/alibi/visual_companion.py. Both PowerShell drivers shrink
from 800+/900+ lines of embedded HTML to ~60-line shims that dot-
source the new scanner/visual-companion-common.ps1.
New
- scanner/visual-companion-common.ps1: ~1100 lines, parser plus
dark-tactical renderer mirroring the canonical Python.
- Activity-by-pattern lifecycle section (both renderers). Per-keyword
tracks on linear time, install diamonds from registry InstallDate,
activity circles from Prefetch/BAM/USB/AppData timestamps. Track-key
fallback Pattern -> Label -> DisplayName -> DeviceName so AppData
findings (Cronus Zen Studio, XIM (other)) get their own tracks.
- scanner/visual_styles.css + visual_scripts.js moved up from the
Python package so both renderers read one source of truth. Python
_load_resource resolves the new path relative to __file__.
Fixes
- Named-items block is now verdict-aware (CHEATS DETECTED separates
input findings to "also"; INPUT DEVICES / MITM / CAPTURE puts all
HIGH in main) and deduplicated by Pattern with a "+N" chip for
corroborating sources. Was emitting "0 named items" with 8 noisy
rows below for input-driven verdicts.
- SVG coords: {0:N1} inserted the en-US thousand separator
("1,196.0"), breaking circle cx/cy and polygon points parsing for
X >= 1000. Lifecycle today-beam rendered on the left, install
diamonds split into hexagons. Replaced with InvariantCulture F1
formatting in Render-Lifecycle, Render-Timeline, Render-Donut.
- Scanner keyword false positives (esp -> FDResPub, hoic ->
CHOICE.EXE, hping -> PATHPING.EXE, loader -> RTSSHooksLoader64,
anticheat -> EasyAntiCheat_EOS): match_keyword / Match-Keyword
gain a bounded mode that wraps short generic patterns in
non-letter/digit lookaround. Applied in scan_network_attack_tools
/ Score-NetworkBlob and scan_lua_scripts / Scan-LuaScripts. Brand
keywords (engineowning, phantomoverlay) keep substring matching.
- visual-companion-common.ps1 + visual-companion-common scanner
added to self-exclusion lists so the renderer module's own keyword
arrays don't trigger self-detection.
Net across existing files: 1781 deletions, 565 insertions. Plus the
new ~1100-line common module and ~70 lines of CSS.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replaces the prior v4.1.5-era handoff. Issue 2 (visual companion port) is shipped in e8ec1f3. Carryover Issue 1 (multi-scan / self-elevation re-entry) is still open and untouched, plus two new top-priority items (field test the v4.2.0 changes on a real fresh scan; regenerate HASHES.txt before next release tag) and six low-priority polish/ backlog items. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Issue 1 ("ran multiple scans") diagnosed from Desktop file listing as a
second Run scan.bat launch ~10 min into Run 1, not a v4.1.5 echo-block
parser regression. Three failure-mode hypotheses (inline fall-through,
non-admin partial scan, UAC self-elevation loop) all ruled out by
timestamps and file sizes. Real latent defect noted: Phase 2 emits no
progress output for ~5 min, making the launcher window look dead and
inviting impatient re-launches.
HASHES.txt regenerated against the current working tree: 6 modified
hashes (forensic-common.ps1, both visual-companion shims, scanners.py,
utils.py, visual_companion.py), 3 added entries (visual-companion-common.ps1,
visual_styles.css, visual_scripts.js under scanner/), 2 removed entries
(visual_styles.css, visual_scripts.js no longer under python/src/alibi/).
sha256sum -c verifies all 37 shipped files OK.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replaces the previous {pc-mode-cheats-detected, pc-mode-clean,
console-rig-capture-stack} trio with three PC-mode reports — one per
verdict tier — so the example set exercises the v4.2 verdict-aware
named-items routing on each side of the CHEATS/non-CHEATS split.
- pc-mode-cheats-detected (user Marcus): full HIGH cheat coverage plus
Cronus/HidHide input findings that route to "named-also" via the new
routing. 8 lifecycle tracks.
- pc-mode-input-devices-detected (user Jordan, NEW): legit-input-stack
shape — XIM Matrix + Cronus Zen + reWASD + HidHide installed, USB
history (VID_2E24 / VID_2516), AppData activity tracks. Zero HIGH
cheats. All HIGH input routes to "main". This is the false-positive
scenario v4.2's bounded keyword matching landed in cleanly.
- pc-mode-clean (user Alex): no recent matches; one HISTORICAL demoted
XIM Manager 2018 keeps the lifecycle section non-empty.
generate_example.py rewritten: shared _emit() helper, fabricated
identities, all three go through build_text_report + render_html so
output is byte-identical to a real scan.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
A forensic anti-cheat scanner ships the same byte patterns AV hunts for
(plaintext cheat-brand keywords, literal high-risk command-string
signatures, self-elevating .bat launchers), so SmartScreen reputation and
heuristic engines flag the GitHub ZIP download. Local Defender scans the
zipball clean, confirming this is reputation/heuristic-driven, not a real
signature hit.
- Remove archive/*.zip — three nested ZIPs of forensic PowerShell were a
zip-in-zip heuristic red flag, weren't in HASHES.txt, and are fully
redundant with git history.
- Document the false positive in README ("If the download is blocked as a
virus") and SECURITY.md ("Antivirus / SmartScreen false positives"):
why it happens, the Mark-of-the-Web Unblock-File fix, VirusTotal/hashes
verification, and the Microsoft false-positive submission path.
- Reframe auditability copy: no opaque archives; history lives in git.
- Update HASHES.txt for the edited README.md / SECURITY.md.
Deliberately NOT done: keyword-DB obfuscation (raises heuristic suspicion
and breaks the read-every-line trust model) and Authenticode signing
(already rejected in SECURITY.md on principle).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Pulled the real detection from Defender history on the GitHub download: Trojan:Script/Wacatac.B!ml — a cloud-ML (!ml) verdict, the classic generic ML false positive. Naming it in SECURITY.md so a reviewer who sees that scary name has the explanation inline. Reported to Microsoft for reclassification. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The GitHub ZIP download of
alibiis blocked by SmartScreen / antivirus as a virus/trojan. A forensic anti-cheat scanner ships, byte-for-byte, the same patterns AV hunts for:keywords.py,forensic-common.ps1),powershell -encodedcommand,iex (new-object net.webclient, …),.batlaunchers running unsigned PowerShell (-ExecutionPolicy Bypass).Verified: local Defender (defs
4.18.26040.7) scans thegit archivezipball clean — so this is SmartScreen reputation + cloud heuristics, not a stable local signature. That rules code-signing/obfuscation in or out on the merits (see below).Changes
archive/*.zip(×3). Nested ZIPs of forensic PowerShell are a zip-in-zip heuristic red flag, weren't inHASHES.txt, and are redundant with git history.README.md— new "If the download is blocked as a virus" section: SmartScreen Keep, the Mark-of-the-WebUnblock-Filefix, VirusTotal/HASHES.txtverification.SECURITY.md— new "Antivirus / SmartScreen false positives" section: why it happens, downloader fixes, the Microsoft false-positive submission path, and an explicit don't-obfuscate / don't-sign rationale.docs/handoff.md— fix the stalearchive\ ← DO NOT DELETEtree entry.HASHES.txt— update SHA256 for the editedREADME.md/SECURITY.md.Deliberately NOT done
SECURITY.mdon principle; would fight the same plain-source trust model.Verification
found no threats(EXIT=0)python -m pytest: 10 passedsha256sum -c HASHES.txt: all listed files verifyarchive/Follow-ups (manual)
SECURITY.md.🤖 Generated with Claude Code