Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Bug]: dowloading of 1.19.2-1 failing Virus detected !! false positive I hope #540

Closed
nostromo1940 opened this issue Dec 27, 2023 · 15 comments
Closed

[Bug]: dowloading of 1.19.2-1 failing Virus detected !! false positive I hope #540

nostromo1940 opened this issue Dec 27, 2023 · 15 comments
Labels
bug Something isn't working stale

Comments

@nostromo1940
Copy link

The problem

When downloading 1.19.2-1 fails with virus detected, Defender reports detecting Trojan:Script/Wacatac.H!ml
Affected items:
containerfile: C:\Users\NWH1GF\Downloads\Winget-AutoUpdate-main (1).zip
file: C:\Users\NWH1GF\Downloads\Winget-AutoUpdate-main (1).zip->Winget-AutoUpdate-main/Sources/WAU Configurator.lnk
webfile: C:\Users\NWH1GF\Downloads\Winget-AutoUpdate-main (1).zip|https://codeload.github.com/Romanitho/Winget-AutoUpdate/zip/refs/heads/main|pid:17136,ProcessStart:133481319344442705

What version of WAU has the issue?

1.19.2-1

What version of Windows are you using (ex. Windows 11 22H2)?

windows 11 23h"

What version of winget are you using?

v1.7.3481-preview

Log information

No response

Additional information

Detected:Trojan:Script/Wacatac.H!ml
Status:Quarantine failed

Affected items:
containerfile: C:\Users\NWH1GF\Downloads\Winget-AutoUpdate-main (1).zip
file: C:\Users\NWH1GF\Downloads\Winget-AutoUpdate-main (1).zip->Winget-AutoUpdate-main/Sources/WAU Configurator.lnk
webfile: C:\Users\NWH1GF\Downloads\Winget-AutoUpdate-main (1).zip|https://codeload.github.com/Romanitho/Winget-AutoUpdate/zip/refs/heads/main|pid:17136,ProcessStart:133481319344442705
@nostromo1940 nostromo1940 added the bug Something isn't working label Dec 27, 2023
@AndrewDemski-ad-gmail-com
Copy link
Contributor

@taffit
Copy link

taffit commented Dec 28, 2023 •
edited
Loading

Same here. At VirusTotal, Fortinet marked it as malicious, Arcsight as suspicious. The Microsoft Defender blocks it completely, with the link marked as malicious.
This came in with the last build! For the previous release, everything is ok. I would treat this as malicious until further notice. The link previously looked completly different. This is what the Defender reports (can't download the file to verify):

webfile: C:\~tmp\WAU-Configurator.zip|https://objects.githubusercontent.com/github-production-release-asset-2e65be/448617645/e7710ebc-d105-4d9d-9723-5186d3ebf3fa?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20231228%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20231228T155814Z&X-Amz-Expires=300&X-Amz-Signature=2d4c54f3fe7fa7d8a904802b3394447d24cfff0e1ce2a9743664e97082ad97f1&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=448617645&response-content-disposition=attachment%3B%20filename%3DWAU-Configurator.zip&response-content-type=application%2Foctet-stream|pid:5936,ProcessStart:133482532884740429

@leberschnitzel
Copy link

it seems to be only the file "WAU Configurator.lnk" inside the archive is "infected".
The shortcut does the following:
%WinDir%\System32\WindowsPowerShell\v1.0\powershell.exe -ep Bypass -w h -C "& {gci -R | Unblock-File; ".\WAU\Gui.ps1"}"

It runs with elevated privileges, sets the execution policy to Bypass, hides the PowerShell window, recursively unblocks all files in the specified directory (which can be useful for removing the "downloaded from the internet" flag), and then executes the Gui.ps1 script located in the .\WAU\ directory.

Creating a shortcut with those parameters doesn't cause it to be flagged, so it seems like there's really something else in the shortcut....

@AndrewDemski-ad-gmail-com
Copy link
Contributor

AndrewDemski-ad-gmail-com commented Jan 7, 2024 •
edited
Loading

This will be recurring theme as long as project sticks to using predefined LNK file.
It will be always some GEN.TROYAN.XYZ or GEN.BADSTUFF.123.
Its all about detection method used by your AV software.
Those are reloaded with every AV update of definitions and there is nothing we could to to satisfy all AV products on the market.

The only way to get rid of this problem is to whitelist this file, but..

  • You cannot whitelist a part of zipped archive
  • You should not whitelist download folder of your web browser or temp folder

.. because that will leave your machine exposed to unnecessary risks.
Malware does not appear on your machines by itself, you do not create it yourself, it is usually downloaded from external systems.

Before Xmas I was planning to write a C# executable which would be used as windowless launcher for the rest of WAU family of products. I have it in my public repo but there is a long road before it will be production ready (compilation workload is missing).

@leberschnitzel
Copy link

I know, a bit "old school", but wouldn't a bat work and not cause a trigger?
%WinDir%\System32\WindowsPowerShell\v1.0\powershell.exe -ep Bypass -w h -C "& {gci -R | Unblock-File; "%~dp0WAU\Gui.ps1"}"

@GhostlyCrowd
Copy link

SentinelONE also has a heart attack over every single lnk made or prepackaged by WAU, it also Killed and Quarantined WAU-Policy.ps1

@AndrewDemski-ad-gmail-com
Copy link
Contributor

I know, a bit "old school", but wouldn't a bat work and not cause a trigger? %WinDir%\System32\WindowsPowerShell\v1.0\powershell.exe -ep Bypass -w h -C "& {gci -R | Unblock-File; "%~dp0WAU\Gui.ps1"}"

As usual, the devil is in the details.
Simply detecting a command for PowerShell to disable/bypass its code execution protection and hide the executed command/command window is enough information for the AV to raise an alarm.

Replacing parameters from the LNK file by moving them to a separate file/script will trigger the same "AV panic".

@taffit
Copy link

taffit commented Jan 18, 2024

Windows Defender now also lets you download the file without any complains.
A small section in the ReadMe explaining potential false alarms and why these can happen (with a link to this issue) may help in the future, as users then already know that this is known and most probably just a false positive and that within days the AV will have corrected it.
Btw, thank you for this wonderful piece of software ...

@github-actions GitHub Actions
Copy link
Contributor

This issue is stale because it has been open for 30 days with no activity.

@github-actions github-actions bot added the stale label Feb 18, 2024
@Romanitho
Copy link
Owner

Thanks :)
Anyway, for the next version we probably need to think about another way to have it simple without antivirus screaming. I thought a "shortcut" would be simple, but I underestimated antiviruses :p

@github-actions github-actions bot removed the stale label Feb 20, 2024
@Romanitho
Copy link
Owner

Romanitho commented Feb 20, 2024 •
edited
Loading

Could you please test with the latest pre-release (1.19.2-7)? Small change, but maybe make the diff :p

@rvtdadmin
Copy link

Could you please test with the latest pre-release (1.19.2-6)? Small change, but maybe make the diff :p

1.19.2-6 and 1.19.2.7 still have this issue with Windows Defender.

@taffit
Copy link

taffit commented Feb 23, 2024

I was able to download both without any problems. But my Defender now doesn't complain even on the 1.19.1, where the problem first arose.

@github-actions GitHub Actions
Copy link
Contributor

This issue is stale because it has been open for 30 days with no activity.

@github-actions github-actions bot added the stale label Mar 25, 2024
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Apr 8, 2024

This issue was closed because it has been inactive for 14 days since being marked as stale.

@github-actions github-actions bot closed this as not planned Won't fix, can't repro, duplicate, stale Apr 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working stale
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@GhostlyCrowd @taffit @leberschnitzel @rvtdadmin @AndrewDemski-ad-gmail-com @Romanitho @nostromo1940