Antivirus software reporting

[monkeycc]

gradio\frpc_windows_amd64

https://weishi.360.cn/jisu/

https://www.360totalsecurity.com/

[abidlabs]

Hmm thanks for reporting. I'm not sure if there's anything we can do here except to confirm that frpc_windows_amd64 is not a virus, it's needed to set share=True.

[ecker00]

Also got this reported, and it's flagged by 36 of 68 vendors on VirusTotal: https://www.virustotal.com/gui/file/c9db0db0f0f41ce3fe84f92a785d4ba0ab351ee231ce9e53924a168889a525fd

What exactly is this file, and why would it be flagged?

[abidlabs]

Hi @ecker00 it's a file that allows you to create a public link for your Gradio app (when you set share=True in your launch() method)

[erhanX]

@abidlabs It is also detected by Defender and quarantined so it is not really helping on Windows unless you give instruction how to whitelist the file or get it out of the virus DBs or just don't care. ;)

[abidlabs]

@erhanX can you try these steps: https://www.makeuseof.com/how-to-whitelist-files-windows-defender/?

[erhanX]

I know how to whitelist. It is not about me. I am just notifying you that any normal Windows user will have this problem. Maybe it was not detected before by Defender when the other person reported it.

Maybe make it an optional package which first gets installed when public=True is used first time and put this information there. Or leave it as it is because people who dont use it will not notice anyway.

[abidlabs]

Maybe make it an optional package which first gets installed when public=True is used first time

That is the current behavior actually

and put this information there

That's a good idea, we'll do that, thanks!

[robertbozsa]

Avast also sees this file as malware and moves it to quarantine.

File: frpc_windows_amd64_v0.2
Threats: FileRepMalware & Win64:Malware-gen
Path: C:\Users\user1\AppData\Local\Programs\Python\Python310\Lib\site-packages\gradio\frpc_windows_amd64_v0.2

Although it is moved to quarantine the application still seems to work. Is this file necessary for something?

This was installed as part of the process to setup a custom knowledgebase for ChatGPT.

https://beebom.com/how-train-ai-chatbot-custom-knowledge-base-chatgpt-api/

[gitihobo]

Multiple anti-virus detect as riskware, anything that can be done about that? How about another script that removes any unnecessary components if you wish to make your environment completely offline?

[ayoubachak]

Maybe make it an optional package which first gets installed when public=True is used first time

That is the current behavior actually

and put this information there

That's a good idea, we'll do that, thanks!

Can you please add a warning for corporate computers, the file singlehandedly blocked every activity in my computer ( antivirus detected it ), now it's taken for maintenance.
I'm pretty sure I won't be the only one who had this issue, I have to mention that I myself went and downloaded the file and it wasn't detected as a malware in the beginning.

[carlthome]

The enterprise security department where I work also alerted on this.

[niccokingdom]

Same here, flagged by corporate, isn't it possible to fix the file, that seems like one of the main straightforward features to be able to share apps? Thanks

[salvasisua2]

McAfee detect...

[Woahai321]

SentinelOne also reports this as malware.

[danmack]

crowdstrike falcon also quarantines this as Adware/Malware.

[mulder1]

Frp component is a reverse proxy written by a Chinese programmer.
It's like saying welcome to trouble if you install it on your computer. No sane corporate environment will allow that

[nucklearproject]

Same problem here 😴

[jblouin]

Symantec also reports this as a security issue

[xarical]

Can I get a confirmation that "Misleading:Linux/FRP.B!MTB" is related to this issue? All I know is that I was in the process of downloading my Gradio project (that uses share=True) for archiving. Heart stopped for a sec when I got the warning from the AV (it didn't mention what triggered the warning, so I can only guess that it's what I had just downloaded) and I'm still trying to figure out whether or not I'm screwed

[cartolid]

Cytomic EPDR also reports it as PUP/generic (and deletes it).

[FurkanGozukara]

my kaspersky antivirus reporting as like this perhaps they can be modified to not report

not super important but just reporting

Today, 29/09/2024 13:11:53;G:\Kosmos-2\venv\Lib\site-packages\gradio\frpc_windows_amd64_v0.2;Not processed;Disinfection not possible;not-a-virus:HEUR:NetTool.Win64.FRP.gen;Postponed;File;G:\Kosmos-2\venv\Lib\site-packages\gradio;frpc_windows_amd64_v0.2;Not processed;Legitimate software that can be used by intruders to damage your computer or personal data;Low;Partially;SECoursesPC\Furkan;Active user

[SH4DY]

Also just ran into this on my corporate machine. Crowdstrike on Apple Silicon.

[rsxdalv]

I don't think this issue should be closed since antiviruses still report it. I'd also prefer if frpc was an optional module so that users can install it, rather than everyone getting a warning.