Virus detected in Windows installer

[marcstober]

When I try to download the version 1.95 Windows installer MSI, from https://github.com/GAM-team/got-your-back/releases, it is blocked by Windows Defender as a virus (https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AWin32%2FMalgent!MSR&threatid=2147742994).

Is there currently a way to install GYB without concern that it has been hacked?

[ideamatrix]

Hit this too — same detection, though in my case it fired on the cached copy in C:\Windows\Installer from an install back in April, which only got flagged on 3 Sept. Same bytes as the release download (verified by hash). Here's what I checked independently, in case it helps others landing here.

Signature check. The MSI is validly signed:

Status:  Valid
Subject: CN="Open Source Developer, James Lee", O=Open Source Developer, L=Plainsboro Township, S=New Jersey, C=US
Issuer:  CN=Certum Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL

The certificate's validity window ended 2 Sept 2026, but the signature still validates because it carries an RFC 3161 timestamp countersignature — anything signed while the cert was live stays valid afterward. If you check yourself and see an expired cert, that's expected, not a problem.

Confirm on your own copy:

Get-AuthenticodeSignature .\gyb-1.95-windows-x86_64.msi | Format-List Status, SignerCertificate

VirusTotal. Microsoft is the only engine flagging it; everything else reads clean. For contrast, MSIs that genuinely carry Trojan:Win32/Malgent!MSR tend to draw 13–18 detections across the panel, with independent vendors naming specific families. One vendor alone is the classic false-positive spread.

Why this probably happens. GYB ships as packaged Python, so the binary is a bootloader that unpacks an interpreter to a temp directory and executes it — structurally identical to a dropper, and the same packaging tooling is used by a lot of real malware. Add what GYB legitimately does (OAuth to Google, then bulk-reading a mailbox to disk) and the behavioral profile reads like a mail stealer. The Certum open-source certificate is genuine authorship attestation but carries little reputation weight with Defender's cloud, so there isn't much on the other side of the scale.

On "has it been hacked": the signature check is what actually answers that. Forging it would require the signing key, not just a modified file — a stronger guarantee than a hash comparison, which only tells you the file matches what was published.

I've submitted it to Microsoft as a false positive via https://www.microsoft.com/en-us/wdsi/filesubmission. Publisher submissions are prioritized over user reports — @jay0lee, one filed as the software developer will likely move faster than mine.

[trystero11]

The Windows ZIP download isn't flagged by Microsoft Defender on my Windows 10 machine, so that's an alternative for folks who can't download the MSI.

[jay0lee]

I've uploaded GYB 1.96. It moves GYB to a modern InnoSetup .exe installer package and ensures all GYB binaries are signed.

In theory this should reduce the false positive reports from AV vendors though there's nothing I can do to fix the AV vendor's errors entirely here.