It's Probably Not a Virus
Corwin Brust (he/him) - IRC: corwin, https://savannah.gnu.org/users/carlc, corwin@bru.st
Format: 20-min talk ; Q&A: BigBlueButton conference room Etherpad: https://pad.emacsconf.org/2026-virus
Etherpad: https://pad.emacsconf.org/2026-virus
Status: Waiting for video from speaker
Description
Two antivirus engines flagged pieces of the official GNU Emacs 31.1 Windows binaries this September: McAfee quarantining preloaded .eln files at startup (bug#81750), and separately, a Trojan:Win32/Suschil!rfn report on the distributed zip itself (help-gnu-emacs, active since September 8). As the volunteer who builds and publishes these Windows binaries, I went looking for an actual defect: a full static-analysis pass across the shipped MINGW64 and UCRT64 sets (PE structure, entropy, import tables, and a byte-for-byte trace of the one specifically-reported export back to its real source) found nothing. I shipped a second release, built without native compilation, specifically to test whether removing the suspected trigger helps – a live experiment, not a fix, and I said so plainly to the mailing lists and to the FSF. This talk walks through that investigation: what static analysis can and can't prove about a false-positive claim, what I found and what I didn't, and what it looks like to narrate an unresolved problem honestly in public rather than waiting for a tidy ending before saying anything. It closes with what's still open as of talk time – including a small, telling case of two VirusTotal scan counts for the same file that don't agree with each other, and what that says about trusting a single number.
About the speaker:
Corwin Brust is a GNU volunteer who builds and publishes the official GNU Emacs Windows binary releases. This talk is a field report from an active, unresolved antivirus false-positive investigation into this year's Windows 31.1 release – what got checked, what didn't turn up an answer, and what shipped anyway while the question stays open.
Questions or comments? Please e-mail corwin@bru.st