7.1.0 release triggers anti-virus

[imzahahs]

My anti-virus claims the following are trojans:

uimgui-7.1.0/Plugins/cimCTE/win-x64/cimCTE.dll - a variant of Win64/GenKryptik_AGen.CVQ trojan - retained
uimgui-7.1.0/Plugins/imguizmo/win-x64/cimguizmo.dll - a variant of Win64/GenKryptik_AGen.CVQ trojan - retained
uimgui-7.1.0/Plugins/imguizmo_quat/win-x64/cimguizmo_quat.dll - a variant of Win64/GenKryptik_AGen.CVQ trojan - retained
uimgui-7.1.0/Plugins/imnodes/win-x64/cimnodes.dll - a variant of Win64/GenKryptik_AGen.CVQ trojan - retained
uimgui-7.1.0/Plugins/imnodes_r/win-x64/cimnodes_r.dll - a variant of Win64/GenKryptik_AGen.CVQ trojan - retained
uimgui-7.1.0/Plugins/implot/win-x64/cimplot.dll - a variant of Win64/GenKryptik_AGen.CVQ trojan - retained
uimgui-7.1.0/Plugins/implot3d/win-x64/cimplot3d.dll - a variant of Win64/GenKryptik_AGen.CVQ trojan - retained

I'm using ESET.

[Nelvin]

Same here - have you done some further investigation / found out whether it's a false positive?

[imzahahs]

I'm not sure how to check for false positives. But it's being detected as a trojan by multiple anti-virus:

https://www.virustotal.com/gui/file/b7ff9ba05bf9c07208852e6fdc883bfa103bb71114e8b59e734bfade4bd4d4d5/detection

Reverting to the older 2025 commit fixes it for me.

[psydack]

Very weird. I’m going to check

…

On Fri, 3 Jul 2026 at 21:56 imzahahs ***@***.***> wrote: *imzahahs* left a comment (psydack/uimgui#91) <#91 (comment)> I'm not sure how to check for false positives. But it's being detected as a trojan by multiple anti-virus: https://www.virustotal.com/gui/file/b7ff9ba05bf9c07208852e6fdc883bfa103bb71114e8b59e734bfade4bd4d4d5/detection <http://url> Reverting to the older 2025 commit fixes it for me. — Reply to this email directly, view it on GitHub <#91?email_source=notifications&email_token=AAHK3M3V6XL2KGXCI7NRAWT5DBI3BA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBYGAYDONJSG4YKM4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#issuecomment-4880075270>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAHK3M5U7OSOIQ5UG2IS44L5DBI3BAVCNFSNUABFKJSXA33TNF2G64TZHMZTMNJXHE4DEMBWHNEXG43VMU5TINRZG42DGMJSGY32C5QC> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AAHK3MZKAKPBBKYOOVBGW4L5DBI3BA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBYGAYDONJSG4YKM4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSVGM33PORSXEX3JN5ZQ> and Android <https://github.com/notifications/mobile/android/AAHK3MYU3B6UVDWE572CZFD5DBI3BA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIOBYGAYDONJSG4YKM4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSXGM33PORSXEX3BNZSHE33JMQ>. Download it today! You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[Brzusko]

@psydack so, any progress on that?

[joshcamas]

I am also seeing this issue.

[psydack]

Thanks for reporting this, and sorry for the delay. I have now completed a source-to-binary audit and rebuilt the complete native stack. Based on the evidence we have so far, the Win64/GenKryptik_AGen.CVQ result on the 7.1.0 files appears consistent with a heuristic/reputation false positive; I found no evidence of malware in the source or rebuilt binaries.

What we checked:

• rebuilt all eight native integrations from source using Dear ImGui/cimgui 1.92.9 and one exact native-stack revision
• the five-platform native matrix passed for Windows x64, x86 and ARM64, Linux x64, and macOS universal
• required exports passed on every platform and the native functional suite passed 7/7
• the managed binding CI passed from a clean runner; the full .NET rebuild/pack completed with 0 errors and 0 warnings
• Unity 6000.5.2f1 compiled the final package and passed 19/19 EditMode tests
• Microsoft Defender scanned the final Plugins tree with security intelligence 1.455.385.0 and reported no threats
• all 16 rebuilt Windows x64/x86 DLLs have ASLR, DEP, Control Flow Guard, reproducible-linking flags, PE file/product version 1.92.9.0, and static MSVC runtime linkage
• their imports are limited to standard Windows libraries (KERNEL32.dll, USER32.dll, SHELL32.dll, and IMM32.dll); there are no VCRUNTIME, MSVCP, or ucrtbase runtime dependencies and no suspicious networking/process-injection imports

The newly rebuilt x64 files corresponding to this report have these SHA-256 hashes:

File	SHA-256
cimCTE.dll	BDEC320E3A46B361E0CC8EF9F682B63ABB0325298701AB2705D970212F9CC0C2
cimguizmo.dll	0E1069B59B3EFB13CDF8F9C7B2829ACE469FC78FCAFA2BBA61E24A00C002A1A5
cimguizmo_quat.dll	EB59B84D52F847F247C7131A23662E49CDADE202EF8B15531062A30B54A5FA42
cimnodes.dll	E59DF8A1B9ACE1BB06C6E9EF33F6A071606125018962C20A191F2E4ACD429FD2
cimnodes_r.dll	16E90C17106D2C23906D747DEB9623E6B7DE6C09BCC6FDA75615908778ADB57A
cimplot.dll	396D74CD9D9CF07ED6B80CA7050356ED9C2F00D99656A045EE6804ECA69330E7
cimplot3d.dll	05EA9AAD567B98B8D8AC44FE3788D4B2861CBD5B6B8225D3F43EC2F2A1E1F1BB

The DLLs are currently unsigned because the project does not yet have an Authenticode code-signing certificate. That, combined with new/low-prevalence hashes, can contribute to generic reputation-based detections. This is not a guarantee that every ESET engine revision will already accept the new files, so vendor-specific retesting is still useful.

Draft PR #94 contains the complete 7.2.0 update if anyone would like to inspect or test it. I am doing the final release checks now and expect to publish 7.2.0 soon. If you can reproduce an ESET detection on one of the new hashes, please post the exact ESET engine/signature version and detection name so we can submit that exact sample to ESET as a false-positive candidate.

[psydack]

VirusTotal/ESET follow-up: I uploaded all seven rebuilt x64 DLLs from PR #94 and waited for the fresh analyses to complete.

ESET-NOD32 18.2.18.0, update 20260728, reported every one of the seven new hashes as undetected. In other words, the original Win64/GenKryptik_AGen.CVQ ESET detection is not reproduced by the rebuilt 7.2.0 binaries.

File	Fresh VirusTotal result	Report
cimCTE.dll	2 malicious, 67 undetected, 1 failure, 4 unsupported	BDEC320E…
cimguizmo.dll	2 malicious, 68 undetected, 4 unsupported	0E1069B5…
cimguizmo_quat.dll	2 malicious, 68 undetected, 4 unsupported	EB59B84D…
cimnodes.dll	0 malicious, 69 undetected, 1 failure, 4 unsupported	E59DF8A1…
cimnodes_r.dll	1 malicious, 68 undetected, 1 failure, 4 unsupported	16E90C17…
cimplot.dll	0 malicious, 69 undetected, 1 failure, 4 unsupported	396D74CD…
cimplot3d.dll	0 malicious, 69 undetected, 1 failure, 4 unsupported	05EA9AAD…

The remaining minority detections are generic/heuristic labels: Microsoft Trojan:Win32/Wacatac.B!ml on four files, Ikarus Trojan.Win64.Krypt on two, and Elastic “malicious (moderate confidence)” on one. As an additional cross-check, I scanned the four Microsoft-flagged hashes individually with local Microsoft Defender engine 1.1.26060.3008 (the same engine version shown by VirusTotal), product 4.18.26060.3008, and definitions 1.455.392.0; all four reported no threats.

Together with the reproducible source build, restricted imports, PE hardening, clean CI, native tests, and Unity tests already documented above, this strongly supports the conclusion that these are low-prevalence heuristic false positives rather than malware. PR #94 is now ready for review/merge. We will keep monitoring the public reports and can submit any persistent minority verdicts to the respective vendors.

[st4rdog]

cimnodes_r.dll is the only one triggering Windows Security for me. Trojan:Win32/Wacatac.B!ml.

[joshcamas]

Looks like the PR is working, no flagging!