[Bug] Scoop reported as malware by Windows

[jmichalak9]

Bug Report

Current Behavior

During scoop update it shows WARN Uncommitted changes detected. Update aborted. This happens because lib/autoupdate.ps1 is deleted by Windows (it is reported as Trojan:Script/Wacatac.B!m).

Expected Behavior

Scoop files not reported as malware. Successful Scoop update.

System details

Windows version: 11

OS architecture: 64bit

PowerShell version: 5.1.22621.2506

Scoop Configuration

{
    "last_update":  "2024-04-21T21:01:15.1074983+02:00",
    "scoop_branch":  "master",
    "scoop_repo":  "https://github.com/ScoopInstaller/Scoop"
}

[chawyehsu]

If you're encountering this, please try to submit it to https://www.microsoft.com/en-us/wdsi/filesubmission to report it a false positive.

---

@niheaven It seems the false positive is raised because of the patch #5901

v0.3.1
https://www.virustotal.com/gui/file/43369f44e355a81dc2c1379ff05f9e00aca2d3c420501d9b9c2577d8093217c8

92b71c6
https://www.virustotal.com/gui/file/86fec3cb86da8f64404538723a15389354a38bfea0aace8e53a8a502081d9691

v0.4.0/PR5901
https://www.virustotal.com/gui/file/c6df0ca246fc75ed71e689433f941bbdcef160f674a4350243c674a10ed718a2

[niheaven]

Wow, I'll use Invoke-WebRequest instead and fix the issue.

[ackalker]

@niheaven I would like to add that scoop checkup - which I would gess is what many users would turn to to check if there are any issues - doesn't report any problems even when the .ps1 file is missing:

PS C:\Users\xxxxx\scoop\apps\scoop\current> git status
On branch master
Your branch is up to date with 'origin/master'.

Changes not staged for commit:
  (use "git add/rm <file>..." to update what will be committed)
  (use "git restore <file>..." to discard changes in working directory)
        deleted:    lib/autoupdate.ps1

no changes added to commit (use "git add" and/or "git commit -a")

PS C:\Users\xxxxx\scoop\apps\scoop\current> scoop checkup
No problems identified!

I think that update functionality being disabled due to Windows Defender would qualify as a ... rather serious problem in my opinion.

[perosb]

Also affects new installs; here in docker making is more difficult to exclude from virus scanner.

2024-04-22T07:30:33.6881729Z Step 7/13 : RUN 	irm get.scoop.sh -outfile install.ps1; 	.\install.ps1 -RunAsAdmin; 	scoop install main/7zip;;
2024-04-22T07:30:33.8430414Z  ---> Running in 3629da8077f1
2024-04-22T07:30:38.4945464Z Initializing...
2024-04-22T07:30:40.6795750Z Downloading...
2024-04-22T07:30:41.6057646Z Extracting...
2024-04-22T07:30:42.8142822Z �[91mCopy-Item : Operation did not complete successfully because the file contains 
2024-04-22T07:30:42.8144321Z �[0m�[91ma virus or potentially unwanted software.
2024-04-22T07:30:42.8145560Z �[0m�[91mAt C:\wdp\install.ps1:623 char:9
2024-04-22T07:30:42.8146883Z �[0m�[91m+         Copy-Item "$scoopUnzipTempDir\scoop-*\*" $SCOOP_APP_DIR -Recu ...
2024-04-22T07:30:42.8147413Z �[0m�[91m+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2024-04-22T07:30:42.8149045Z �[0m�[91m    + CategoryInfo          : WriteError: (autoupdate.ps1:FileInfo) [Copy-Item 
2024-04-22T07:30:42.8150110Z �[0m�[91m   ], IOException
2024-04-22T07:30:42.8153508Z �[0m�[91m    + FullyQualifiedErrorId : CopyDirectoryInfoItemIOError,Microsoft.PowerShel 
2024-04-22T07:30:42.8155033Z �[0m�[91m   l.Commands.CopyItemCommand
2024-04-22T07:30:42.8157965Z �[0m�[91m 
2024-04-22T07:32:20.4560304Z �[0mThe command 'powershell -Command $ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue'; irm get.scoop.sh -outfile install.ps1; 	.\install.ps1 -RunAsAdmin; 	scoop install main/7zip;' returned a non-zero code: 1

[ooooo84]

Not only Window Defender but the CrowdStrike Falcon malware scan also detected it.

[mattia72]

The v0.4.1 release is not a malware here anymore ;)
scoop\apps\scoop\current\lib\autoupdate.ps1 is not deleted.

[brad-jones]

v0.4.2 still appears to be effected. Running CrowdStrike Falcon here.