Trojan Crypt in Spytify?

[kylemcshea]

Hi all, I was just given a notification of a trojan crypt hidden in spytify. I am no computer expert, just wanted to make sure spytify didn't make an accidental pull request that should have not happened.

[jwallet]

I went and read about this kind of alert:https://www.spywareremove.com/removetrojancrypt.html

I can confirm this is a false positive Spytify does not do that. The only web browser page it opens is when you are using spotify api, we ask you to log in into your account to authorize spytify api to use your account to search for metadata of the current song that is being played, since spotify api is private and the app does not come with it's own client id for spotify.

there are also buttons on the UI that links to the project website.

[jwallet]

so I found out a bit more information, I found out that using prevent to sleep is seen has a trojan, spytify tells the system to not go to sleep until the recording session is done, and it does not like that.

see with powershell as admin, that spytify gets attached to events: powercfg /requests

after adding some more code to spytify recently, I added what microsoft recommanded for media recorders and use ES_AWAYMODE_REQUIRED

Away mode should be used only by media-recording and media-distribution applications that must perform critical background processing on desktop computers while the computer appears to be sleeping.

#336

After adding this mode, I now see on my tests machines that the app is now completly deleted on execution and it's falsy flagged as a trojan:Win32/Wacatac.G!ml which is a virus that :

will drop several malicious files on the computer, especially on system folders. The threat will then add a registry entry to run the malicious code on each Windows start-up. It is also able to conceal itself by loading the code as Critical Windows process. This technique is also one way to make it invisible from virus and malware scanners.

https://malwarefixes.com/threats/trojanwin32-wacatac-dml/

what I did is that I removed that commit, so the recorder becomes less effective when away from keyboard, but I cannot removed PreventToSleep completely otherwise it compromises the recorder, as soon as the computer comes back from sleep the recorder will resume and add all the wave buffer (spotify continued to play) into one file