JKI Dragon classified as malware

[GICA-VS_M]

I am trying to install JKI Dragon 2024.3.0. Build 662 but my antivirus blocks it for suspected malware.

I cannot disable antivirus - it is company run.

Is this normal?
Anyone has similar problems?

What to do?

[altenbach]

You can contact IT and have them report this to the AV company to investigate and fix with the next update. What is the name of the security software?

[GICA-VS_M]

Thanks Rolf.

Malware detection is integrated in Admin By Request and the list of AV's is quite long (click here for the list).

Although https://vipm.io is trustworthy (click here), my IT asks if it may have been hacked and a malware version of 'JKI Dragon' installer planted there - which is a rightful concern.

I also wrote to Jim on VIPM's forum, but got no reply so far. Maybe if you send Jim a quick note, I am sure your "chime" is way more effective than mine 😉

[altenbach]

---

@GICA-VS_M wrote:

Thanks Rolf.

---

Who is Rolf?

---

@GICA-VS_M wrote:

... the list of AV's is quite long (click here for the list).

---

Wow, what a can of worms that seems to suffer from "too many cooks"!

Maybe you can upload it to Virustotal  to see which part fails it.

[GICA-VS_M]

Sorry Chris.

I mistook your logo for Rolf Kalbermatter's.

[GICA-VS_M]

Virustotal results:

So, is there something 'fishy' or is it just a false positive? (which is perfectly possible)

[altenbach]

So 3 flagged it and 68 considered it safe.... 😄

(No way for me to judge what the problem is, of course 😄 )

[GICA-VS_M]

I would agree, of course.

Now, heads on to convince my IT!

[McQuillan]

Hi All,

Thanks for making us aware of this. In the upcoming weeks we will be releasing an update that has a few changes to the installer and certificates, (as well as general enhanced LV25 support). So stay tuned, and we should have this resolved before too long.

[Jim_Kring]

---

@GICA-VS_M wrote:

Virustotal results:

So, is there something 'fishy' or is it just a false positive? (which is perfectly possible)

---

Short answer: you can probably download the NIPKG version of the Dragon installer and have better success with your antivirus/IT department.

PS: I don’t see a direct link to the nipkg file on https://dragon.vipm.io, but JKI can work to make that link more “readily accessible” from the website.

Longer answer:
I can think of a handful of reasons why an antivirus service would not want to give the dragon online installer its blessing: in extracts a zip archive into a temp folder, executes a binary, and then proceeds to download other stuff to install on your computer. This “pattern” of behavior, coupled with unfamiliarity with the binaries, is most likely the heuristics that “modern” (AI-based antivirus detection “algorithms”) use to flag a file as possible malware. There are a variety of ways a software vendor can try to prove/assert that their binaries are safe (signing with a certificate, registering with antivirus companies, using visual studio’s compiler instead of gcc, etc.), yet none of them are perfect.