Virus Total detects malicious code
dodgyb opened this issue · comments
Checked ConfigureDefender_x64.exe on Virus Total and 3 engines reported malicious software:
Antiy-AVL - Trojan/Generic.ASVCS3S.1E5
CrowdStrike Falcon - malicious_confidence_60% (W)
McAfee-GW-Edition - BehavesLike.Win64.Dropper.tc
Antiy-AVL - Trojan/Generic.ASVCS3S.1E5
SentinelOne - static engine - malicious
Sophos ML - heuristic
ConfigureDefender executables are always submitted to Microsoft, Avast, Symantec, BitDefender, and Emsisoft before publishing. The application changes Defender settings and some Windows Policies, so some behavior-based detections can flag it as suspicious/malicious.
Microsoft Defender also blocks download because of a virus...
Microsoft Defender also blocks download because of a virus...
Are you sure? Many people on BleepingComputer, MalwareTips, and WildersSecurity forums use ConfigureDefender and no one reported such an issue. I checked it also on my computer with Edge. Both SmartScreen and PUA protection in Edge allow downloading without alerts. I can also run the application without Defender's alert.
What was the source of the downloaded file?
Was the file digitally signed? (it should be)
Could you please recheck the issue?
Please check if the downloaded file is ConfigureDefender application or only the download assistant from the website which hosts application installers. The download assistant executables are often detected as PUA.
See also there for more info:
https://malwaretips.com/threads/configuredefender-utility-for-windows-10.79039/post-926725
It seems that @firebowl did not download the ConfigureDefender installer but the whole GitHub repository in ZIP archive: ConfigureDefender-master.zip. For an unknown reason, the whole archived repository was flagged by Defender despite the fact that all files included in the archive were detected as clean. I submitted the archived repository to Microsoft today and the false positive has been removed with AntivirusSignatureVersion: 1.329.2695.0.
Thank @firebowl, guys from MalwareTips and Wilderssecurity forums the issue has been finally solved.