Windows 10 detects SuperSorter 1.0.6 as a virus

[MS]

When I realized SuperSorter was no longer sorting I tried to reinstall it, but Windows 10 blocked this attempt, reporting a virus was detected. 

I realized false positives are possible but I have given up on the extension for now. 

[Richard Corner]

That's very strange. I wonder why it is not sorting for you. If you want me to look into it please could you let me know which version of Chrome you're running and what settings you use in SuperSorter? Also if your bookmarks are in Chrome's Bookmarks Bar please check that you don't have "Ignore Bookmarks Bar" switched on in the options page.

I have not heard of a virus alert happening before. But just to make sure, I ran SuperSorter 1.0.6 (both my own development copy and the published CRX file from the Chrome Web Store) through Bitdefender and VirusTotal, and they didn't detect anything. So I'm pretty confident this is a false positive if you got it from the Chrome Web Store. Which antivirus gave you the alert?

Thanks,

Richard.

[Alex Cardenas]

I am presently getting the same result from Microsoft Defender Antivirus. Just the default windows 10 one. I downloaded the crx and ran it through a few online detectors, they all said its fine supposedly. Its coming up as "Trojan:Win32/Emotet!ml". I'm currently running it through the online Microsoft submission process. with any luck they will update soon.

[MS]

>  Also if your bookmarks are in Chrome's Bookmarks Bar please check that you don't have "Ignore Bookmarks Bar" switched on in the options page.

I have some in the bookmarks bar, and I realized that I needed to play with that option in SuperSorter settings. But when I tried to reinstall I got the virus notification and gave up for the moment.

The notification came from Windows Defender. The original system where I saw the notification was Windows 10. I just now tried installing again on a Windows 11 machine -- with a minty fresh OS install and little else -- and I got the same warning. No huge surprise I guess, they probably share the same threat database. 

If there is a widespread false positive impacting Windows users I would expect more discussion here, though. It's very strange. 

Anyway, the current notification is happening on this system: 

Chrome 112.0.5615.87 (Official Build) (64-bit) (NOT the very very latest, it wants me to restart Chrome, which was installed a few days ago)

Windows 11 Version 10.0.22000 Build 22000 (NOT the very very latest, I installed it a few days ago and all self-updates are incomplete)

Windows Defender Security Intelligence Version 1.387.1359.0 (4/17/2023)

By the way, thank you for the extension. While I am having trouble now it's been very helpful in the past! 

[Richard Corner]

Thank you both for the information. Just as a further precaution, I scanned all the SuperSorter source code and all the packages it depends on with Bitdefender, and again it found nothing. I also checked the packages it depends on for known vulnerabilities and that didn't turn anything up either. I'm setting up a virtual machine with Windows 10 to test with, and if I can replicate the detection I'll submit a false positive report to Microsoft too.

And MS, I'm glad you have found the extension useful. If you do get to try it again after this antivirus thing is sorted out, and if you still have an issue with sorting, please let me know.

Thanks,

Richard.

[Alex Cardenas]

the submission came back as clean, the response says the false positive has been removed, and to update definitions.

[Richard Corner]

That's great. Thank you for your help with this!

Best,

Richard.