[Bug 59279] New: dplaysvr.exe & dpvsetup.exe: Win.Malware.Zusy Malware Detected

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59279

            Bug ID: 59279
           Summary: dplaysvr.exe & dpvsetup.exe: Win.Malware.Zusy Malware
                    Detected
           Product: Wine
           Version: 11.0
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: major
          Priority: P2
         Component: dplay
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Good afternoon,
We build/install WINE from source and have recently noticed that ClamAV detects
the installed dplaysvr.exe & dpvsetup.exe binaries as malicious.


Build steps:
[install Ubuntu 22.04 deps]
mkdir -p build
cd build
git clone https://gitlab.winehq.org/wine/wine.git
cd wine && git checkout stable && git pull
cd -
mkdir -p ./build/{wine-32,wine-64}
cd ./build/wine-64 && ../../wine/configure CFLAGS='-march=native -O3 -pipe
-fstack-protector-strong' --enable-win64 --without-xshm
cd ../wine-32 && PKG_CONFIG_PATH=/usr/lib/pkgconfig ../../wine/configure
CFLAGS='-march=native -O3 -pipe -fstack-protector-strong'
--with-wine64=../wine-64 --without-xshm
cd ../wine-64 && make -j$(($(nproc) - 1))
cd ../wine-32 && make -j$(($(nproc) - 1))
make install -j$(($(nproc) - 1))
cd ../wine-64 && sudo make install -j$(($(nproc) - 1))


Malware detection:
root@wine-bld-test:~/build/build# clamscan -v
/usr/local/lib/wine/*-windows/d*.exe  | grep FOUND
/usr/local/lib/wine/i386-windows/dplaysvr.exe: Win.Malware.Zusy-9883755-0 FOUND
/usr/local/lib/wine/i386-windows/dpvsetup.exe: Win.Malware.Zusy-9883754-0 FOUND
/usr/local/lib/wine/x86_64-windows/dplaysvr.exe: Win.Malware.Zusy-9883755-0
FOUND
/usr/local/lib/wine/x86_64-windows/dpvsetup.exe: Win.Malware.Zusy-9883754-0
FOUND


Is this a known false-positive, or is something funny going on?

Thank you!

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 59279] dplaysvr.exe & dpvsetup.exe: Win.Malware.Zusy Malware Detected

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59279

Alexandre Julliard <[e-mail]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |INVALID
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #1 from Alexandre Julliard <[e-mail]> ---
It's a false positive.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 59279] dplaysvr.exe & dpvsetup.exe: Win.Malware.Zusy Malware Detected

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59279

[e-mail] changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|INVALID                     |FIXED

--- Comment #2 from [e-mail] ---
Thank you for the prompt response.

Is there documentation about the known false-positives anywhere? I looked but
couldn't find anything.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 59279] dplaysvr.exe & dpvsetup.exe: Win.Malware.Zusy Malware Detected

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59279

Alexandre Julliard <[e-mail]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|FIXED                       |INVALID

--- Comment #3 from Alexandre Julliard <[e-mail]> ---
There are many similar reports out there for random Wine dlls, they are always
false positives. Most AVs do rudimentary pattern checks that seem very easy to
trigger with our PE modules.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 59279] dplaysvr.exe & dpvsetup.exe: Win.Malware.Zusy Malware Detected

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59279

Gijs Vermeulen <[e-mail]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #4 from Gijs Vermeulen <[e-mail]> ---
Closing INVALID.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.