[[!meta title="It's Probably Not a Virus"]]
[[!meta copyright="Copyright © 2026 Corwin Brust"]]
[[!inline pages="internal(2026/info/virus-nav)" raw="yes"]]

<!-- Initially generated with emacsconf-publish-talk-page and then left alone for manual editing -->
<!-- You can manually edit this file to update the abstract, add links, etc. --->


# It's Probably Not a Virus
Corwin Brust (he/him) - IRC: corwin, <https://savannah.gnu.org/users/carlc>, <mailto:corwin@bru.st>

[[!inline pages="internal(2026/info/virus-before)" raw="yes"]]

Two antivirus engines flagged pieces of the official GNU Emacs 31.1
Windows binaries this September: McAfee quarantining preloaded .eln
files at startup (bug#81750), and separately, a
Trojan:Win32/Suschil!rfn report on the distributed zip itself
(help-gnu-emacs, active since September 8). As the volunteer who
builds and publishes these Windows binaries, I went looking for an
actual defect: a full static-analysis pass across the shipped
MINGW64 and UCRT64 sets (PE structure, entropy, import tables, and
a byte-for-byte trace of the one specifically-reported export back
to its real source) found nothing. I shipped a second release,
built without native compilation, specifically to test whether
removing the suspected trigger helps &ndash; a live experiment, not a
fix, and I said so plainly to the mailing lists and to the FSF.
This talk walks through that investigation: what static analysis
can and can't prove about a false-positive claim, what I found and
what I didn't, and what it looks like to narrate an unresolved
problem honestly in public rather than waiting for a tidy ending
before saying anything. It closes with what's still open as of
talk time &ndash; including a small, telling case of two VirusTotal
scan counts for the same file that don't agree with each other,
and what that says about trusting a single number.

About the speaker:

Corwin Brust is a GNU volunteer who builds and publishes the
official GNU Emacs Windows binary releases. This talk is a field
report from an active, unresolved antivirus false-positive
investigation into this year's Windows 31.1 release &ndash; what got
checked, what didn't turn up an answer, and what shipped anyway
while the question stays open.



[[!inline pages="internal(2026/info/virus-after)" raw="yes"]]

[[!inline pages="internal(2026/info/virus-nav)" raw="yes"]]