# Pyinstaller - false positive? **URL:** \ **Category:** Python Help\ **Tags:** help\ **Created:** [January 14, 2024, 4:03pm UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171 "2024-01-14T16:03:38Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![anon73324083](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@anon73324083](https://discuss.python.org/u/anon73324083)\ **Post date:** [January 14, 2024, 4:03pm UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171/1 "2024-01-14T16:03:38Z")
I wanted to use pyinstaller to convert python file into exe file, but I see this : ![image](https://us1.discourse-cdn.com/flex002/uploads/python1/original/3X/a/2/a21ce6ea01e5fdd6dbc47a367d11d67ad791e16b.png) Avast tell me my exe file is a Trojan 😕 I think it’s a fake positive, but I’m not sure about that. Thank you. ---
**Author:** ![barry-scott](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@barry-scott](https://discuss.python.org/u/barry-scott)\ **Post date:** [January 14, 2024, 4:55pm UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171/2 "2024-01-14T16:55:21Z")
You can submit your file to avast as a false positive so that the detection can be fixed here: [False Positive File Form](https://www.avast.com/false-positive-file-form.php) All antivirus software seems to have such a facility. ---
**Author:** ![anon73324083](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@anon73324083](https://discuss.python.org/u/anon73324083)\ **Post date:** [January 14, 2024, 6:13pm UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171/3 "2024-01-14T18:13:18Z")
Do you know if that the file is really a Trojan or a fake positive ? ---
**Author:** ![barry-scott](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@barry-scott](https://discuss.python.org/u/barry-scott)\ **Post date:** [January 14, 2024, 6:33pm UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171/4 "2024-01-14T18:33:51Z")
I have seen pyinstall apps be flagged in the past, but i am assuming that you know the code you are using is clean. The term is “false positive” usually not “fake positive”. ---
**Author:** ![anon73324083](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@anon73324083](https://discuss.python.org/u/anon73324083)\ **Post date:** [January 14, 2024, 7:21pm UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171/5 "2024-01-14T19:21:00Z")
😅Yes you are right. Thank you ! ---
**Author:** ![anon73324083](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@anon73324083](https://discuss.python.org/u/anon73324083)\ **Post date:** [January 15, 2024, 8:20pm UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171/6 "2024-01-15T20:20:54Z")
I changed the title. ---
**Author:** ![Stefan2](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/stefan2/32/18492_2.png) [@Stefan2](https://discuss.python.org/u/Stefan2)\ **Post date:** [January 15, 2024, 10:36pm UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171/7 "2024-01-15T22:36:28Z")
> [@anon73324083](#): > > Do you know if that the file is really a Trojan or a fake positive ? What do all the other scanners at [virustotal.com](http://virustotal.com) say? ---
**Author:** ![anon73324083](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@anon73324083](https://discuss.python.org/u/anon73324083)\ **Post date:** [January 15, 2024, 11:55pm UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171/8 "2024-01-15T23:55:34Z")
Yes : [Shorturl.exe virustotal result](https://www.virustotal.com/gui/file/03e6ca37ab5e29f1ea182dfef51d2baa8317b6257392ce30c9a321b5c22c4b35?nocache=1) I think it’s a false positive but at this stage… ---
**Author:** ![kknechtel](https://avatars.discourse-cdn.com/v4/letter/k/e47c2d/32.png) [@kknechtel](https://discuss.python.org/u/kknechtel)\ **Post date:** [January 16, 2024, 7:29am UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171/9 "2024-01-16T07:29:50Z")
As long as your antivirus thinks that Pyinstaller _itself_ is clean, there should be no problem with anything it creates. Some anti-virus programs use heuristics to look for suspicious programs, because there are too many ways that a virus could be slightly changed to avoid detection. I can easily imagine ways that programs created by a system like Pyinstaller could look suspicious - for example, if they work by trying to extract a Python interpreter from inside the executable file itself. ---
**Author:** ![barry-scott](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@barry-scott](https://discuss.python.org/u/barry-scott)\ **Post date:** [January 16, 2024, 9:27am UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171/10 "2024-01-16T09:27:54Z")
Pyinstaller .exe files are a boot strap, the static python interpreter and a zip files of .pyc files all in one. There is no need to extract the interpreter. ---
**Author:** ![Stefan2](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/stefan2/32/18492_2.png) [@Stefan2](https://discuss.python.org/u/Stefan2)\ **Post date:** [January 16, 2024, 1:54pm UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171/11 "2024-01-16T13:54:56Z")
Hmm, that seems like a relatively large number of scanners that detect something. If they’re all false positives, maybe it would be good to ask the PyInstaller makers to do something about it. Do you get that many detections with a minimal Python program (e.g., just `print('hello world')`) as well? ---
**Author:** ![fungi](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/fungi/32/5963_2.png) [@fungi](https://discuss.python.org/u/fungi)\ **Post date:** [January 16, 2024, 2:49pm UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171/12 "2024-01-16T14:49:12Z")
My understanding is that antivirus companies primarily maintain databases of “signatures” that are essentially subsets of the contents of known malware samples. Tools like PyInstaller are very good at what they’re designed for: making a stand-alone executable application out of a Python-based project. Malware is also just software, and the people who write it software developers, so it’s not at all surprising that some prefer to write their malware in Python and turn it into stand-alone executables with PyInstaller. The result is that (especially non-cryptographically-signed) applications built with PyInstaller run a significant chance of getting detected as malware even when they aren’t, if common PyInstaller-created bit patterns in the files are identical to subsets of actual malware executables created with PyInstaller. I’ve seen a lot of small open source projects struggle with exactly this, particularly getting detected as malware by Windows Defender, and if they reach out to Microsoft support they’re usually told the “solution” is to set up an application signing infrastructure and pay to register their signing key. Apparently you can also send in your application as a non-malware sample and ask them to retrain their database to ignore it, but even if they get around to it you’re still looking at possibly hitting the same problem again the next time you publish a new release and the contents of your executable change slightly. And it’s not just PyInstaller-created executables that run into this, pretty much any free or easily pirated tool for creating stand-alone executables out of interpreted languages faces the same challenges. ---
**Author:** ![anon73324083](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@anon73324083](https://discuss.python.org/u/anon73324083)\ **Post date:** [January 16, 2024, 3:32pm UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171/13 "2024-01-16T15:32:18Z")
I will try. Same problem with a simple : ```auto print("Hello Word !") ``` ![image](https://us1.discourse-cdn.com/flex002/uploads/python1/original/3X/b/d/bd3d627487cb26fda70267223540b71627ae470e.png) ---
**Author:** ![barry-scott](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@barry-scott](https://discuss.python.org/u/barry-scott)\ **Post date:** [January 16, 2024, 4:44pm UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171/14 "2024-01-16T16:44:03Z")
> [@fungi](#): > > I’ve > seen a lot of small open source projects struggle with exactly this, > particularly getting detected as malware by Windows Defender, and if > they reach out to Microsoft support they’re usually told the > “solution” is to set up an application signing infrastructure and > pay to register their signing key. When my pyinstaller app hit this issue all I did was submit the exe to microsoft on their web site and in due course the problem was fixed. Never needed to involve support. ---
**Author:** ![fungi](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/fungi/32/5963_2.png) [@fungi](https://discuss.python.org/u/fungi)\ **Post date:** [January 16, 2024, 4:57pm UTC](https://discuss.python.org/t/pyinstaller-false-positive/43171/15 "2024-01-16T16:57:41Z")
> When my pyinstaller app hit this issue all I did > was submit the exe to microsoft on their web > site and in due course the problem was fixed. > Never needed to involve support. Makes sense. Where support has come up, from what I’ve seen, is in trying to find out how to prevent the problem from recurring for subsequent releases of a project.