FMSynth_5ContinuousOutputs example gets flagged as containing a virus on OSX

[JimParticipant]

Just a quick heads up:
Virus detected at FMSynth_5ContinuousOutputs.App/Contents/MacOS/.BC.T_9qkj5A seen as OSX/Backdoor.Eleanor,Trojan by McAffee antivirus. Found directly from downloading the Mac examples zip essentials_v1_2_mac

[RebeccaKeymaster]

Hi Jim,

I’m very sorry for overlooking this for so long. I was just contacted by email by another user who found the same thing using McAffee, and I found your post.

The good news (I think) is that McAffee may be wrong here.

I created the file FMSynth_5ContinousOutputs using a free (and legitimate, non-virus/malware) software called Platypus. It wraps up Mac executables so you can double-click on them and give them an icon.

The creators of OSX/Backdoor.Eleanor also used Platypus to make their app (see https://www.macrumors.com/2016/07/06/backdoor-mac-eleanor-faq/), and it looks like other people who’ve made software using Platypus have also been flagged by McAfee as matching this software (e.g., https://www.jamf.com/jamf-nation/discussions/20521/app-packager-is-being-flagged-as-eleanor-malware, http://stumpy.vuse.vanderbilt.edu/Malware.htm).

I will look into this further and try to find an alternative to Platypus that won’t cause this issue, but I don’t think there’s anything to actually worry about.

[JimParticipant]

Hi Rebecca,

Thanks for the info, thought it might be a false positive.

Best,
Jim

[Author]

Posts