[BUG] At startup Window tries to re-install

[Antoon1955]

I start my PC and windows says the files needed for installing LGTV companion are on another network.
It doesn't need to be installed though because it already is and working fine.
To get rid of it I tried to re-install manually but then I get Bitdefender warnings:

Antivirus

The file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LGTV Companion.lnk is infected with Gen:Variant.Lazy.577051 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.

It also gives warnings about the LGTV C. website.

[JPersson77]

Hi, thanks for your report!

Regarding the bitdefender virus statement - diligent care is taken to ensure that there are no virus attached to the installer and executables. All executables and installers are compiled from source on github, as part of a github action, i.e. they are not compiled on my machine. This is specifically to avoid the slim possibility that I accidentally spread a virus due to my machine being infected with something. Running the installer (v4.0.5) through virus total shows a clean record: https://www.virustotal.com/gui/file/c27fb8c5f424b449363d54f4bdfb7fc2ba785a891ec553b2c9047fc6b886c73b

If your PC is prompting you to (re)install LGTV companion on PC start-up it should be because an upgrade installation failed at an earlier point, probably due to the system not being able to terminate currently running executables (in order to replace them). If your antivirus is flagging these files, improperly, then I suppose it is likely you will experience the issues you describe.

The question is - why does your antivirus flag the executables as virus/malware?

Did you download the installer from github?

I recommend to:
1 uninstall LGTV Companion. Delete the installers already downloaded
2 ensure via task manager that LGTVsvc.exe, LGTVdaemon.exe, LGTV Companion.exe or LGTVcli.exe is not running.
3 delete c:/program files/lgtv companion (if not already deleted)
4 check that c:/program data/lgtv companion/ only contains config.json (and potentially log.txt if logging is enabled). You can delete these files too but then you need to setup the app again as the json contain the configuration.
5 Run a full system scan with at least two different antivirus products and take action on any potential threats. I use Windows Defender and Malwarebytes
6 Use Autoruns (Sysinternals) to check if there are anything you do not recognize which autostarts with the PC.
7 Download the most current installer from here : https://github.com/JPersson77/LGTVCompanion/releases
8 Scan the installer with Bitdefender. If the installer is flagged as containing a virus you can according to me assume it is a false positive (due to what I described in the first paragraph). To progress at this point you must either a) get Bitdefender to fix the issue so that the executables are not flagged (mind that they are not flagged by Bitdefender in Virus Total) or b) manually whitelist the application so that Bitdefender does not scan them. But hopefully the installer/executables do not get flagged at this point and instead you can...

9 Install as usual. If you did not delete config.json your settings should have been preserved.

[david-at-edlio]

I get this error when trying to download the latest installer from here: https://github.com/JPersson77/LGTVCompanion/releases

[JPersson77]

I can only tell you what I said above. Bitdefender seems bent on flagging the executable, but I believe it is a false positive for reasons mentioned above. If you believe that too please submit the executable to bitdefender and tell them that their product erroneously flag the executable, and then whitelist the executable to be able to download, install and use.

[Antoon1955]

Thanks for the fast and detailed response. It worked!. I managed to whitelist the installation file and the executable in Bitdefender and it’s running fine. From: JPersson77 ***@***.***> Sent: dinsdag 30 juli 2024 16:53 To: JPersson77/LGTVCompanion ***@***.***> Cc: Antoon1955 ***@***.***>; Author ***@***.***> Subject: Re: [JPersson77/LGTVCompanion] [BUG] At startup Window tries to re-install (Issue #234) Hi, thanks for your report! Regarding the bitdefender virus statement - diligent care is taken to ensure that there are no virus attached to the installer and executables. All executables and installers are compiled from source on github, as part of a github action, i.e. they are not compiled on my machine. This is specifically to avoid the slim possibility that I accidentally spread a virus due to my machine being infected with something. Running the installer (v4.0.5) through virus total shows a clean record: https://www.virustotal.com/gui/file/c27fb8c5f424b449363d54f4bdfb7fc2ba785a891ec553b2c9047fc6b886c73b If your PC is prompting you to (re)install LGTV companion on PC start-up it should be because an upgrade installation failed at an earlier point, probably due to the system not being able to terminate currently running executables (in order to replace them). If your antivirus is flagging these files, improperly, then I suppose it is likely you will experience the issues you describe. The question is - why does your antivirus flag the executables as virus/malware? Did you download the installer from github? I recommend to: 1 uninstall LGTV Companion. Delete the installers already downloaded 2 ensure via task manager that LGTVsvc.exe, LGTVdaemon.exe, LGTV Companion.exe or LGTVcli.exe is not running. 3 delete c:/program files/lgtv companion (if not already deleted) 4 check that c:/program data/lgtv companion/ only contains config.json (and potentially log.txt if logging is enabled). You can delete these files too but then you need to setup the app again as the json contain the configuration. 5 Run a full system scan with at least two different antivirus products and take action on any potential threats. I use Windows Defender and Malwarebytes 6 Use Autoruns (Sysinternals) to check if there are anything you do not recognize which autostarts with the PC. 7 Download the most current installer from here : https://github.com/JPersson77/LGTVCompanion/releases 8 Scan the installer with Bitdefender. If the installer is flagged as containing a virus you can according to me assume it is a false positive (due to what I described in the first paragraph). To progress at this point you must either a) get Bitdefender to fix the issue so that the executables are not flagged (mind that they are not flagged by Bitdefender in Virus Total) or b) manually whitelist the application so that Bitdefender does not scan them. But hopefully the installer/executables do not get flagged at this point and instead you can... 9 Install as usual. If you did not delete config.json your settings should have been preserved. — Reply to this email directly, view it on GitHub <#234 (comment)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/BCFUYRPGKBGGWBJOYRQ54JDZO6SEPAVCNFSM6AAAAABLWHLU5SVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENJYGU2DSMRZGI> . You are receiving this because you authored the thread. <https://github.com/notifications/beacon/BCFUYRL6MF2O23QVHA36473ZO6SEPA5CNFSM6AAAAABLWHLU5SWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTUGT25CY.gif> Message ID: ***@***.*** ***@***.***> >

[Ellathar]

Running the installer (v4.0.5) through virus total shows a clean record: https://www.virustotal.com/gui/file/c27fb8c5f424b449363d54f4bdfb7fc2ba785a891ec553b2c9047fc6b886c73b

It does show 7/65 vendors marking it as unsafe. How is that a clean record ?

[dechamps]

All executables and installers are compiled from source on github, as part of a github action, i.e. they are not compiled on my machine.

This, and by the way, if you want to check that for yourself, you can download the installer from the GitHub Actions run itself and verify for yourself that it is the exact same file as the one attached to the release (SHA256 hash starting with c27fb8c5). You can then proceed to the corresponding GitHub Actions workflow and from there you have access to the entire source code that GitHub Actions used to build this specific output, and you can thus convince yourself that it does not contain anything malicious. At that point you don't have to trust any of the authors anymore - you only have to trust GitHub, which is owned by Microsoft. These are very strong guarantees - it means LGTVCompanion de facto meets SLSA Build Level 3, which is no joke. It's definitely much stronger than some false positive from some antivirus.

By the way @JPersson77 if you want to improve even further on this workflow, here are a couple of tips I discovered since I wrote it:

1. You can have the workflow create a draft release for you on every tag push, with the installer already attached, so you don't have to download and re-upload the files
   • This reduces the risk of alteration, even if just accidental (e.g. uploading the wrong file)
2. You can sign the installer using sigstore and then attach the resulting signature to the release - this makes it possible for people to verify (with strong cryptographic guarantees) that the installer really came from a GitHub Actions run on the specific commit, even after the logs and outputs from the GA run disappear (which happens after 90 days).
   • Actually, now that I think about it, it may make more sense to generate an SLSA attestation, which I suspect would be easier for users to verify. Then you can proudly add this badge to your README ;)

[JPersson77]

@Ellathar it was a clean record at the time the link was pasted.

Thanks @dechamps for explaining the situation well! I will definitely look into both of the improvements you have outlined.

Bottom line as far as I can tell is that some antivirus vendors erroneously flag the latest installer. There is, like was already mentioned, no need to take my, or anyone else's, word for it however - just inspect the source and follow the instructions above to verify that the installer was built as part of a github workflow action :)