I get the following message when attempting to download the latest version of NCrunch.
Malware Detected
The transferred file contained a virus and was therefore blocked.
URL: http://downloads.ncrunch.net/NCrunch_VS2015_2.19.0.4.msi
Media Type: application/executable, application/dotnet-assembly
Virus Name: McAfeeGW: BehavesLike.Win32.Suspicious.cm
It *looks* to my untrained eye like a heuristic match as opposed to a "real" match, but I leave that to the experts to determine. Please advise, thanks! D
In case it wasn't obvious, the AV engine in use here is McAfee. It runs on our (proxy?) server and not my local machine, so I can't just turn it off. The McAfee instance blocks Free Download Manager from accessing the file as well.
It's things like this that really ruffle my feathers ...
This is a false positive caused by a bad scanning tool. You can confirm this by using the online scanner at https://www.virustotal.com, which runs the file through 53 other scanners and reports it as clear.
I'm currently reviewing to see what options I have for convincing McAfee that their scanner is wrong, but I expect this will involve layers of bureaucracy and may take some time.
Have you tried installing the product manually via ZIP?
I've made a submission to McAfee's detection dispute service. Apparently this takes 4-6 weeks before they consider the submission. I've also submitted the installed files through their false positive submission system. As a software author, this is unfortunately the limit of what I'm able to do. I recommend seeing what options you may have available for excluding the install files from the proxy or if there are other options for you to report the false positive as a McAfee customer.
I purchased the license personally, though I use it at work. Since it's not part of the standard image, I'm pretty sure my employer will do nothing to assist. Your suggestion to use the .zip instead sounds sound (I'm kinda cheesed I didn't think of it myself), so I'll try that on Monday. Thanks!
Malware Detected
The transferred file contained a virus and was therefore blocked.
URL: http://downloads.ncrunch.net/NCrunch_VS2015_2.20.0.4.msi
Media Type: application/executable, application/dotnet-assembly
Virus Name: McAfeeGW: BehavesLike.Win32.BackdoorNJRat.lm
Interestingly, I have the 2015 version installed as well, and only the 2017 AppContainer.exe tripped the detection.
Thanks!
That's very interesting. The AppContainer.exe files are identical between installations of NCrunch. These files actually haven't changed since the Windows Store integration was introduced several years ago. If you aren't using the old Windows Store integration, you could probably even delete them.