Windows Defender flags the Windows installer as a virus

[mwnu]

When I download Tesseract-0.8.7-AMD64.exe from the Releases page, Windows Defender detects it as:

• Detection: Trojan:Win32/Ulthar.A!ml
• Severity: Severe

I'm not sure whether this is a false positive or a genuine issue. The !ml suffix suggests it's a machine-learning heuristic detection, but I can't confirm one way or the other.

Could you please take a look and verify:

1. Whether the release binary matches the source code
2. If you can reproduce this detection on your end
3. Consider submitting the file to Microsoft for analysis if it's a false positive

In the meantime, I'll hold off on installing it. Others might want to be cautious as well until this is clarified.

Thank you.

[surakin]

Ok that's weird.... The installer was generated by a GitHub action runner. They are still unsigned, that's probably what's causing this. Still trying to sort that out.

In the meantime you can always build it yourself, but if that's not an option, caution is of course always the best course.

(I personally have installed it myself in several machines without any issues).

Thanks for reporting, I'll try to sort the installer signing ASAP.

[surakin]

In the meantime I threw it to VirusTotal

And submitted it to Microsoft to see if Defender can calm down a bit :)

[surakin]

I'm closing this, since there is not much more to be done right now - Feel free to raise it again if it comes back.

[Clusters]

@surakin
Unfortunately it came back with another !ml (Trojan:Win32/Wacatac.C!ml) detection from Defender for Tesseract-0.8.11-AMD64.exe

https://www.virustotal.com/gui/file/a41b5738351dd4577753bf35e33976dd0088eaf5f7544fc354307068be377dc9/

[surakin]

Ah well, time to get a signing certificate.