It's Probably Not a Virus
Corwin Brust (he/him) - IRC: corwin, https://savannah.gnu.org/users/carlc, corwin@bru.st
The following image shows where the talk is in the schedule for Sun 2026-12-13. Solid lines show talks with Q&A via BigBlueButton. Dashed lines show talks with Q&A via IRC or Etherpad.
Format: 20-min talk ; Q&A: BigBlueButton conference room https://media.emacsconf.org/2026/current/bbb-virus.html
Etherpad: https://pad.emacsconf.org/2026-virus
Discuss on IRC: #emacsconf
Status: Waiting for video from speaker
Sunday, Dec 13 2026, ~2:00 PM - 2:20 PM MST (US/Mountain)
Sunday, Dec 13 2026, ~1:00 PM - 1:20 PM PST (US/Pacific)
Sunday, Dec 13 2026, ~9:00 PM - 9:20 PM UTC
Sunday, Dec 13 2026, ~10:00 PM - 10:20 PM CET (Europe/Paris)
Sunday, Dec 13 2026, ~11:00 PM - 11:20 PM EET (Europe/Athens)
Monday, Dec 14 2026, ~2:30 AM - 2:50 AM IST (Asia/Kolkata)
Monday, Dec 14 2026, ~5:00 AM - 5:20 AM +08 (Asia/Singapore)
Monday, Dec 14 2026, ~6:00 AM - 6:20 AM JST (Asia/Tokyo)
Description
Two antivirus engines flagged pieces of the official GNU Emacs 31.1 Windows binaries this September: McAfee quarantining preloaded .eln files at startup (bug#81750), and separately, a Trojan:Win32/Suschil!rfn report on the distributed zip itself (help-gnu-emacs, active since September 8). As the volunteer who builds and publishes these Windows binaries, I went looking for an actual defect: a full static-analysis pass across the shipped MINGW64 and UCRT64 sets (PE structure, entropy, import tables, and a byte-for-byte trace of the one specifically-reported export back to its real source) found nothing. I shipped a second release, built without native compilation, specifically to test whether removing the suspected trigger helps – a live experiment, not a fix, and I said so plainly to the mailing lists and to the FSF. This talk walks through that investigation: what static analysis can and can't prove about a false-positive claim, what I found and what I didn't, and what it looks like to narrate an unresolved problem honestly in public rather than waiting for a tidy ending before saying anything. It closes with what's still open as of talk time – including a small, telling case of two VirusTotal scan counts for the same file that don't agree with each other, and what that says about trusting a single number.
About the speaker:
Corwin Brust is a GNU volunteer who builds and publishes the official GNU Emacs Windows binary releases. This talk is a field report from an active, unresolved antivirus false-positive investigation into this year's Windows 31.1 release – what got checked, what didn't turn up an answer, and what shipped anyway while the question stays open.
Questions or comments? Please e-mail corwin@bru.st