Malware?

[CheminerWill]

I am having trouble running OpenSAK with Malwarebytes and also Avast antivirus. I get messages like the below. I can restore it and create an exception but don't want to if "Win64:Malware-Gen" is a real thing?

[Fabio-A-Sa]

Hi!

Thanks for reporting this. We’ll take a look as soon as possible.

For now, the short answer is: no. OpenSAK is a fully open-source desktop application, and we do not include, and never will include, any malware or suspicious code. That’s one of the benefits of being open source: all of the code is publicly available and can be inspected by anyone.

My suspicion is that this may be caused by one of the dependencies used by the application triggering a false positive in your antivirus software. I’ll investigate it more closely and see what might be causing the alert.

[CheminerWill]

OK. Thanks. I told the programs to allow it and create an exception for opensak.exe. Now it opens and runs fine. However, when I go to the user guide, I get the following warning. I suppose it is a false positive also, but I wonder why?

[AgreeDK]

Thanks for reporting this, CheminerWill — and thanks Fabio for opening the issue.

This is a false positive. OpenSAK is clean, open-source software. What's happening is well-known in the Python community: antivirus tools like Avast and Malwarebytes often flag executables built with PyInstaller because the PyInstaller "bootloader" (the code that unpacks and launches the Python runtime) looks suspicious to heuristic scanners. The detection name Win64:Malware-gen is a generic heuristic label — not a signature match against known malware.

You can verify this yourself:

• The full source code is available here on GitHub
• Our Windows builds are produced automatically by GitHub Actions — you can inspect the build workflow to see exactly how the .exe is created
• VirusTotal results for our latest release: (add link when available)

The permanent fix is code signing. A signed executable tells Windows and antivirus software that the binary comes from a verified publisher, which eliminates false positives. We are actively working on acquiring a code signing certificate — this is one of the reasons we are setting up OpenSAK as a non-profit to cover the annual cost (~€280/year).

In the meantime, you can safely add opensak.exe as an exception in Avast/Malwarebytes. We understand this is not ideal and we apologize for the inconvenience.

We will update this issue once the executable is signed.

[CheminerWill]

Can I assume it is OK to add exceptions for opensak.com website also so I can look at the user guide?

[Fabio-A-Sa]

Yes, sure. opensak.com is generated based on the current code repository over HTTPS.

[AgreeDK]

The user guide is also in this repo under files/doc/ its a HTML file you can read in your browser.

[CheminerWill]

Thanks. All good. I added the website to Avast exceptions and it works now. Interesting as this was the first exception I have ever needed to add in 10+ years of using Avast. I also reported it to them as a false positive. Malwarebytes was OK with the website so did not need to do anything there. Now I have an unrelated database question that I did not see addressed in the user guide but I will ask that in a new thread.