1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
|
[[!meta title="It's Probably Not a Virus"]]
[[!meta copyright="Copyright © 2026 Corwin Brust"]]
[[!inline pages="internal(2026/info/virus-nav)" raw="yes"]]
<!-- Initially generated with emacsconf-publish-talk-page and then left alone for manual editing -->
<!-- You can manually edit this file to update the abstract, add links, etc. --->
# It's Probably Not a Virus
Corwin Brust (he/him) - IRC: corwin, <https://savannah.gnu.org/users/carlc>, <mailto:corwin@bru.st>
[[!inline pages="internal(2026/info/virus-before)" raw="yes"]]
Two antivirus engines flagged pieces of the official GNU Emacs 31.1
Windows binaries this September: McAfee quarantining preloaded .eln
files at startup (bug#81750), and separately, a
Trojan:Win32/Suschil!rfn report on the distributed zip itself
(help-gnu-emacs, active since September 8). As the volunteer who
builds and publishes these Windows binaries, I went looking for an
actual defect: a full static-analysis pass across the shipped
MINGW64 and UCRT64 sets (PE structure, entropy, import tables, and
a byte-for-byte trace of the one specifically-reported export back
to its real source) found nothing. I shipped a second release,
built without native compilation, specifically to test whether
removing the suspected trigger helps – a live experiment, not a
fix, and I said so plainly to the mailing lists and to the FSF.
This talk walks through that investigation: what static analysis
can and can't prove about a false-positive claim, what I found and
what I didn't, and what it looks like to narrate an unresolved
problem honestly in public rather than waiting for a tidy ending
before saying anything. It closes with what's still open as of
talk time – including a small, telling case of two VirusTotal
scan counts for the same file that don't agree with each other,
and what that says about trusting a single number.
About the speaker:
Corwin Brust is a GNU volunteer who builds and publishes the
official GNU Emacs Windows binary releases. This talk is a field
report from an active, unresolved antivirus false-positive
investigation into this year's Windows 31.1 release – what got
checked, what didn't turn up an answer, and what shipped anyway
while the question stays open.
[[!inline pages="internal(2026/info/virus-after)" raw="yes"]]
[[!inline pages="internal(2026/info/virus-nav)" raw="yes"]]
|
