Total Virus accuses Trojan.Malware in Laragon

[iury89]

I would really like to use Laragon to replace Xampp but unfortunately both the portable version and the full installation are showing viruses, all the exe files are reporting viruses and my antivirus won't let them install, I know it could be a false positive, but please resolve it This Laragon is wonderful and you did an incredible job, but you need to release a new version that is 100% safe and without false positives

[iury89]

Be careful, they are using the comments to spread Lumma Stealer through email notifications with a false solution to this problem, the correct thing would be for @leokhoa to solve this problem and finally have a safe solution, create a link for donations or a paid pro version so that we can pose to help.

but github deleted it, be careful more information >>
https://www.techradar.com/pro/security/lumma-stealer-malware-linked-as-project-fixes-in-github-comments

[leokhoa]

@iury89 :
I’m not sure why, but it might be because the auto-virtual host feature modifies the Windows system hosts file.

[iury89]

@leokhoa Thank you very much for the answer, if possible create a version without this feature presented to us so that they are not blocked by antivirus and make a txt with the entries in the hosts, so that you can finally install laragon without blocks, if you can do it at least in the portable version It would help a lot.

[alxndr-w]

@iury89 or you could just uninstall your snake-oil anti-virus software and stay with Microsoft Defender.

Of course, software that is meant for developing may has to change your system, like the hosts file. That is something, laragon does and your anti-virus software wants to protect you from this in general.

So instead "fixing" laragon, just fix your choice of anti-virus software or treat the warning as what it is: a false-positive.

[Sophist-UK]

Just because an anti-virus product flags changing a host file does not make it "snake-oil" - personally I would want my AV to flag a host file change because it is definitely something that malware might want to do.

But as @alxndr-w says, you can tell your AV that this is OK for Laragon.

[alxndr-w]

@Sophist-UK sure. But Windows or any modern OS in 2024 already prevent such things and 3rd-party AV-software can in fact be a security hole by itself.

In this case, Laragon in fact triggers User Account Control and kindly asks for the hosts file write access.

[iury89]

Thank you very much for the answers, but even though it's a false positive, I'm not going to disable my antivirus, I ended up choosing to go back to xampp, as I said, the ideal would be to create a lite version without changing the hosts or anything that bothers the antivirus, and leaving for the user to have a safe option to install on their machine, in my opinion this is hindering the growth of laragon, because xampp is much worse than Laragon, but at least it seems safe and reliable.

[Sophist-UK]

You don't need to disable your antivirus completely. You just need to tell your AV software that the single Laragon.exe executable is allowed to change the hosts file.

[Sophist-UK]

@alxndr-w said:

In this case, Laragon in fact triggers User Account Control and kindly asks for the hosts file write access.

Actually, saying yes to User Account Control authorises that executable to do a whole bunch of things other than just changing the Hosts file. One of the things that decent AV/firewall software provides is fine-grained access control which allows access to Hosts but avoids access to other things.

Or you can simply assign more generous security privileges to the Hosts file to allow Laragon to change it.