Windows AV blocking opening zen.exe due to virus/trojan found in the executable.

[TrueHerobrine]

[mr-cheff]

virus detection websites dont detect anything so I dont know why is windows AV complaining...

[TrueHerobrine]

I might try to whitelist the exe. I'll get back with an update.

[TrueHerobrine]

Update: Just tried again without adding an exception and it works flawlessly. TLDR: Windows is weird.

[mr-cheff]

Windows is weird. Thanks a lot for trying it out!

[TrueHerobrine]

No worries! Found it on Reddit and was actually very impressed. I have my own browser but I'm not forking it off of anything, so it's cool to see an indie browser thriving like this!

[DavidGreen63]

In the last 30 minutes, while I was accessing a site, using version 1.0.0-a.29 (64-bit), Windows Defender terminated the App and deleted the core executable.

[clembu]

Same happened to me. Admittedly my Defender is very weird and Windows Security crashes when I try to open it, so I can't open the UI to add exclusions or inspect things that way, but a.28 works

[danmaxis]

It happened to me too, mine Zen was flagged by Kaspersky when I tried to import data from another browser.

[Meathelix1]

Windows 11
Version 10.0.22631 Build 22631

Zen was installed directly from the website. https://www.zen-browser.app/

Windows Defender Picked it up as soon as I opened Zen.exe

Trojan Name = "Wacatac.B!ml"

I dont want to be excluding something with that name, a quick google search will show you this is a popular one.

[Xavi-X333]

I have the same problem, first the core executable was deleted and then a can't download the installer :/

[DavidGreen63]

Maybe it is an issue that will fade once Zen gets a signature, but as it stands, its normal operations are being flagged as Malware/Trojan like. I think I'll look into Zen again once it gets a little less alpha or beta-ish.

[Meathelix1]

The Generic Version does not pick up as a Trojan. It's just the Optimized Version.

[HamzaConcepts]

Virustotal is also showing it as some trojan script. Are all of these just false positives?

[extropyst]

Check this information:
https://virustotal.readme.io/docs/false-positive

and try also analyzing the file in other places like:

https://internxt.com/virus-scanner

https://opentip.kaspersky.com/

[jakehower]

Getting blocked for me too.

[soulhax]

Exactly the same problem as others are having. Also the installer is detected as PUA:Win32/Packunwan.
Idk but I'm not satisfied with the answer "Windows is weird". I guess we're going to wait until this exe and thing are going to be signed and stuff. Peace.

[MatfenV1]

Same issue here, it worked just fine when I installed it on my desktop but my laptop refuses installing it.

[Abelkrijgtalles]

Same here (Windows 11 Pro 23h2)

[J-Cake]

Just wanted to report that this is still happening. System: Windows 11 Pro 22H2 Build: 22621.3880

[MikeyA-yo]

I also get this same trojan script, this made me uninstall zen immediately

[Abelkrijgtalles]

Could this maybe have a connection to the new windows defender update? 1.0.0-a.29 was released 2 days ago, but this problem only started about 9 hours ago.

EDIT: The latest update I've installed (defender version 1.417.317.0), doesn't include anything about Trojan:Script/Wacatac.B!ml.

[alexugthub]

Just tried to install the Zen browser on a Windows 10 and it blocks it claiming that there's a "PUA:Win32/Packunwan" virus

[DavidGreen63]

I am on Win 10 Pro, and after the core executable was annexed, I attempted to uninstall. The uninstall would not function, which did surprise me. Maybe the missing file was causing the uninstaller to fail.
I just deleted the folder where the application had been stored.
Judging from the previous posts on this thread, I will definitely consider carefully before any re-install before a signed binary is available.

[FeraltCode]

Did you get it from the zip file or installer?

Installer

For me this looks ok

That's weird, for me shows as not signed

[markox92]

@FeraltCode just updated to 1.0.1-a.6 and here is

[jgonzales20]

@FeraltCode just updated to 1.0.1-a.6 and here is

still getting unsigned DLL's

[markox92]

Which dll ? If is AccessibleMarshal.dll looks fine for me.

[jgonzales20]

Which dll ? If is AccessibleMarshal.dll looks fine for me.

Link: https://www.virustotal.com/gui/file/068347961d00e4c0842c7eb5764a1338b869b62ac4a855feca703be6728da3d3?nocache=1

All three of these files are unsigned.
Link: https://www.virustotal.com/gui/file/30073077a83770dc3c13110d2499067343bc882fab51aef074479be492a40c3c/relations

[meguroyama]

Did you get it from the zip file or installer?

Used the installer and the installer on it's own is fine but the bundled / extracted files are the issue here.

[markox92]

@jgonzales20 how is it possible that the same file AccessibleMarshal.dll has a different size on my and your PC? For me, VT reports that file is signed for you, unsigned wtf?? :(

[mr-cheff]

I see non of the files are signed on the installer... Hmmm

[jgonzales20]

@jgonzales20 how is it possible that the same file AccessibleMarshal.dll has a different size on my and your PC? For me, VT reports that file is signed for you, unsigned wtf?? :(

It's coming from the installer.

[jgonzales20]

Latest Update:

[szpatrik5]

Had to reinstall 1.0.1-a.8 from setup. None of the files are signed. And the blocking started again...

[mrmind77]

Same by Kaspersky

Hoy, 15/10/2024 21:55:12;Se detectó un objeto malicioso;Zen Browser;zen.exe;C:\Program Files\Zen Browser;26164;MENTE\josue;Iniciador;Detectado: PDM:Trojan.Win32.Generic;Detectado;PDM:Trojan.Win32.Generic;Troyano;Alta;Exacta;zen.exe;zen.exe;C:\Program Files\Zen Browser;Proceso;Análisis de comportamiento

[jgonzales20]

a. 10 is receiving the following detections.

[jgonzales20]

@mauro-balades a.12 still has two unsigned files in the installer.

Virus total: https://www.virustotal.com/gui/file/90cb7c445fd7a99c05f8aae60fb49ea4e7a84f69449b5a4a9b10c4af3d441cb5/relations

[FeraltCode]

AV flagged Zen once more, I ran the Installer (Executable, Optimized, downloaded through website) through VirusTotal and there are 5 unsigned files

[daviddelven]

and what about this?

[TiboGabriels]

Pallo Alto XDR has been flagging it too on occasion, today was this alert:

[jgonzales20]

I believe these false positives will occur until this goes to stable as you can't get a signing cert until you are in production / out of alpha

[leic4u]

I got this problem with v1.0.1-a.21 in my PC just now, while intalled in my laptop correctly.

PC information:

OS: 24H2 
Windows Security Application Version: 1000.27703.0.1006
Windows Security Platform Version: 10.0.27703.1006-0
Microsoft Defender Antivirus Platform version: 4.18.24090.11
Engine Version: 1.1.24090.11
security intelligence update: 1.421.516.0

[siddhant-dev]

its because the windows exe file needs to singed as per microsoft's protocol. I guess only the production version will have it

[mr-cheff]

Im still investigating into how I can properly fix this issue for once and for all. I think there's a slight issue when signing the executables inside the installer