Trojan:Win32/Zpevdo.B

[Jonerrok]

Affected items:
file: C:\Program Files (x86)\Myrtille\bin\wfreerdp.exe

2020-10-16 07:52:12,065 [4] INFO System.Diagnostics redirection [(null)] - Connecting remote session *, type RDP, security AUTO, server (:port) *, vm (none), domain (none), user , program (none)
2020-10-16 07:52:12,518 [4] ERROR System.Diagnostics redirection [(null)] - Failed to start the host client process, remote session * (System.ComponentModel.Win32Exception (0x80004005): Operation did not complete successfully because the file contains a virus or potentially unwanted software
at System.Diagnostics.Process.StartWithCreateProcess(ProcessStartInfo startInfo)
at Myrtille.Services.RemoteSessionProcess.StartProcess(Guid remoteSessionId, HostType hostType, SecurityProtocol securityProtocol, String serverAddress, String vmGuid, String userDomain, String userName, String startProgram, Int32 clientWidth, Int32 clientHeight, Boolean allowRemoteClipboard, Boolean allowPrintDownload, Boolean allowAudioPlayback))

[cedrozor]

Hi,

Thanks for your report. Yes, I also saw that a few days ago, a Windows update of Windows Defender decided that FreeRDP is a threat. This is a false positive of course, but it breaks Myrtille by quarantining the FreeRDP executable. The next entry you will have in Myrtille.Services.log is that wfreeedp.exe is missing (...)

This is what I posted a fews ago on the Myrtille group (I should had created an issue here after that):

I was reported today a zpevdo.B trojan detection by Windows Defender on wfreerdp.exe (the rdp client used by Myrtille) after a Windows update on a Windows Server 2016 machine.

This is a false positive, as already stated this summer by the FreeRDP team (FreeRDP/FreeRDP#6336) and is probably due to the fact FreeRDP uses low level APIs calls to handle remote access. The Virus Total scan of wfreerdp.exe, as bundled into Myrtille 2.9.0, doesn't report this threat (even if there are 3/68 heuristic detections).

So, don't worry if you have such detection on FreeRDP. Problem is, Windows Defender may quarantine wfreerdp.exe, thus breaking Myrtille. If this happens, you can safely restore it and add a security exclusion for it so that it doesn't happen anymore. You can also use another anti-virus (as a double check in case such a thing happen).

This happened on a Windows Server 2016. On which OS did you had this problem ?

[Jonerrok]

Hello, im not sure that this was decide by mistake, because ~10 days older builds dont have this issue. Had on windows server 2019.

Anyway is it possible to take screen shot from remote desktop with pure php via curl or some manipulation with sockets?

Best regards

[cedrozor]

It must be due to a recent Windows update (less than 10 days), which in turn updated the Windows Defender threats database. That's why this issue didn't happened before.

It might be due to the fact the FreeRDP executable is not signed (same issue here: stride3d/stride#285 or here). I will see to do that, along with the other myrtille binaries (including the installer).

Meanwhile, false positives can be reported to Microsoft here: https://www.microsoft.com/en-us/wdsi/filesubmission

To reply to your last question, it would be difficult taking screenshots with php, moreover in virtualized sessions, and with a huge loss of performance if even possible.

[cedrozor]

I verified this happen since Windows Defender 1.325.805.0 (latest: https://www.microsoft.com/en-us/wdsi/defenderupdates).

As a side note, Windows Defender can be configured to prompt the user for action instead of quarantining files silently...

[cedrozor]

I reported the false detection to Microsoft which reacted quite switfly. It should be fine now:

@The-Compiler you should also do a report at https://www.microsoft.com/en-us/wdsi/defenderupdates
@Jonerrok could you please update Windows Defender to definition 1.325.945.0 and re-scan (myrtille install path)\bin\wfreerdp.exe?
I will anyway sign the Myrtille executables and installer in the next release to avoid such troubles

[The-Compiler]

@The-Compiler you should also do a report at https://www.microsoft.com/en-us/wdsi/defenderupdates

I assume you mean https://www.microsoft.com/en-us/wdsi/filesubmission, right?

[cedrozor]

Yes (wrong link copy&paste)

[The-Compiler]

Turns out it doesn't actually get detected anymore - I guess whatever fixed it for your project also fixed it for mine. Thanks for taking care of it!

[AceMoneus]

Hi!

Today I tried to install Myrtille 2.9.0.
Got the same Windows Defender detection so I uploded the .msi to virustotal.com: 16 different engines detected various malwares. Probably false positives, but should I be worried?

[cedrozor]

Hi @AceMoneus thanks for your input. MSI files aren't executable files, they are a database containing compressed data for msiexec.exe, the Windows installer engine. It's like having an .mp4 video file detected as a virus, although it's run by an external player and doesn't contain any executable code by itself.

After installation, the Myrtille binaries (exe and dlls) aren't detected by any AV (except wfreerdp.exe, as a false positive).

The Myrtille 2.8.1 MSI (and the versions before) wasn't detected by any AV. Nothing changed in 2.9.0 except the false positive detection of wfreerdp; so I guess it must have come from that. As explained, FreeRDP does many things low level, a recent feature might have triggered this detection (for example usbredirect, recently added to FreeRDP).

I will continue to investigate. I already checked my build machine and it's clean (I guess the other executables would have been infected otherwise, which is not the case).

[cedrozor]

By the way, did you updated Windows Defender (via Windows Updates) to latest definition? (>= 1.325.945.0)

[AceMoneus]

Ah, ok. I was thinking of msi:s as a sort of kompressed folders. Like most antivirus agents do open zip-files and examine the content.
Actually, I don't know my version. Where do I see that? Under "Virus & threats" it only says that I'm using Microsoft Defender.
I have all the updates that MS Update gives me, so at least I want to think that I'm on the latest of everything...
Anyway, your explanation seems legit so I'll go for it. Thx 👍

[cedrozor]

https://www.bleepingcomputer.com/tutorials/how-to-find-windows-defender-version-number-installed-in-windows-10/

[cedrozor]

Closing now. I will sign the Myrtille executables (including the FreeRDP fork) into a next version and re-check then.