Kaspersky reports Trojan horse `Trojan-Spy.Win32.Stealer.fonw`

[iopass4]

Version

• v1 (has no resource to fix)
• v2

Platform

• Macos
• [ x] Windows
• Linux

Description
Kaspersky reports Trojan horse Trojan-Spy.Win32.Stealer.fonw

User Type: Initiator
Application Name: chrome.exe
Application Path: C:\Program Files\Google\Chrome\Application
Component: File Threat Protection
Result Description: Detected
Type: Trojan
Name: Trojan-Spy.Win32.Stealer.fonw
Accuracy: Exact
Threat Level: High
Object Type: File
Object Name: wox-windows-amd64.exe
Object Path: C:\Users\Administrator\Downloads
Object SHA256: 858FE47D64A707C89D4F089DA4475B5C1A62ED71E6C7841ABAD3DE486F35FA1F
Object MD5: D9E28E899A1FECBB661878EA379E0C43

Log

please upload wox log to help identify your bug.

• ~/.wox/log/log if you use macos or linux
• C:\Users\<yourname>\.wox\log\log if you use windows

[qianlifeng]

Yes, I am checking where this false positive is triggered.

[yanqiukong]

I’ve encountered the same issue.
The beta5 version works fine, but beta6 through beta8 are consistently flagged as malicious by Kaspersky.

[qianlifeng]

Could you try this latest compiled version? I don't have Kaspersky installed locally, but it has passed all VirusTotal scans.
https://github.com/Wox-launcher/Wox/actions/runs/21035852413

https://www.virustotal.com/gui/file/b4793a96af643668d72aac4e2dd05ac704f52a6b6e4e717007c30651404844f2?nocache=1

[iopass4]

Could you try this latest compiled version? I don't have Kaspersky installed locally, but it has passed all VirusTotal scans. https://github.com/Wox-launcher/Wox/actions/runs/21035852413

https://www.virustotal.com/gui/file/b4793a96af643668d72aac4e2dd05ac704f52a6b6e4e717007c30651404844f2?nocache=1

This package did not report any viruses.

[yanqiukong]

Could you try this latest compiled version? I don't have Kaspersky installed locally, but it has passed all VirusTotal scans. https://github.com/Wox-launcher/Wox/actions/runs/21035852413

https://www.virustotal.com/gui/file/b4793a96af643668d72aac4e2dd05ac704f52a6b6e4e717007c30651404844f2?nocache=1

I tested the rebuilt version you provided.
It was clean at first, but after a system reboot, Kaspersky flagged it again.
事件: 检测到恶意对象 用户: LAPTOP-603A17LU\11322 用户类型: 活动用户 应用程序名称: explorer.exe 应用程序路径: C:\Windows 组件: 文件反病毒 结果说明: 检测到 类型: 木马 名称: Trojan-PSW.Win32.Stealer.dabh 精确度: 确切 威胁级别: 高 对象类型: 文件 对象名称: wox-windows-amd64.exe 对象路径: C:\Users\11322\Desktop MD5: E05645EA749A3F24EE362F49C9C80D6F 原因: 数据库 数据库发布日期: 今天，2026/1/20 15:49:00

[qianlifeng]

Could you try this latest compiled version? I don't have Kaspersky installed locally, but it has passed all VirusTotal scans. https://github.com/Wox-launcher/Wox/actions/runs/21035852413

https://www.virustotal.com/gui/file/b4793a96af643668d72aac4e2dd05ac704f52a6b6e4e717007c30651404844f2?nocache=1

I'm a bit confused. It clearly showed no problems back then, but now when I check this link again, it shows 5 dangerous behaviors. Why is that?

[qianlifeng]

When I upload the analysis using the latest compiled version now, it says there are no problems at all. Let's wait two days to see if these are still working.

https://www.virustotal.com/gui/file/fea4432f4136f14768f5cbfeaf5f08670d06fe48e5c705a660cbe034760fe54d?nocache=1

https://opentip.kaspersky.com/FEA4432F4136F14768F5CBFEAF5F08670D06FE48E5C705A660CBE034760FE54D/results?tab=upload

Statement
Each Wox build utilizes GitHub artifact attestations to establish a trusted certificate for the build source, such as this one: https://github.com/Wox-launcher/Wox/attestations/16930417. This ensures the compiled version you obtain originates precisely from our specific commit, with absolutely no possibility of private tampering. You may inspect the source code at any time to verify that Wox does not exhibit the trojan-like behavior alleged by certain antivirus software (such false positives often stem from Wox requiring elevated privileges for operations like scanning files and applications, monitoring the clipboard, or handling system hotkeys). We hope this addresses any concerns regarding false positives.

[qianlifeng]

Thanks to SignPath for providing the open-source code signing certificate. This should help reduce false positives for trojan viruses on Wox. Let's see if this signed version still triggers false positives. At least it's working fine now 😄

https://www.virustotal.com/gui/file/423f779367d70bee0fbdf95470b831c57f428d2f0e04e5fc097a3f7c4894d499/detection

[J4s0nHu4n9]

Hi @qianlifeng

The latest version (v2.0.0)
https://github.com/Wox-launcher/Wox/releases/tag/v2.0.0
https://github.com/Wox-launcher/Wox/releases/download/v2.0.0/wox-windows-amd64.exe

Kaspersky reports UDS:Trojan-PSW.Win32.Stealer.dbuy
https://www.virustotal.com/gui/file/f1ba2f36316eb17f6276c8a07b1364f941722c83391a19231d49e08580b39c95/detection

(Both on locally and VirusTotal)

[qianlifeng]

Hi @qianlifeng

The latest version (v2.0.0) https://github.com/Wox-launcher/Wox/releases/tag/v2.0.0 https://github.com/Wox-launcher/Wox/releases/download/v2.0.0/wox-windows-amd64.exe

Kaspersky reports UDS:Trojan-PSW.Win32.Stealer.dbuy https://www.virustotal.com/gui/file/f1ba2f36316eb17f6276c8a07b1364f941722c83391a19231d49e08580b39c95/detection

(Both on locally and VirusTotal)

This is truly baffling. Between yesterday's version and today's v2.0.0 release, I barely made any changes. The VirusTotal link from yesterday still shows no viruses. I'm a bit confused myself.