Rclone 1.5.6 - Windows finds Trojan:Win32/CryptInject!MSR

yeah, strange, not sure why that did not work,
perhaps my test was flawed tho i did post the output and ran the test several times, including direct on the command line, not using a script.

i agree about editing a binary, but have been doing that for decades. most often that works.

as for upx, most often that works.
anti-virus program has nirsoft

doit.cmd
Process started (PID=19200) >>>

d:\data\u\nirsoft\1.23.37\NirSoft\x64>cd /d D:\data\u\nirsoft\1.23.37\NirSoft\x64 

d:\data\u\nirsoft\1.23.37\NirSoft\x64>del passwordscan.upx.exe 

d:\data\u\nirsoft\1.23.37\NirSoft\x64>upx.exe passwordscan.exe -opasswordscan.upx.exe -q 
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2020
UPX 3.96w       Markus Oberhumer, Laszlo Molnar & John Reiser   Jan 23rd 2020

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
    593408 ->    286208   48.23%    win64/pe     passwordscan.upx.exe

Packed 1 file.

d:\data\u\nirsoft\1.23.37\NirSoft\x64>copy passwordscan*.exe C:\data\rclone\scripts\exe 
passwordscan.exe
passwordscan.upx.exe
        2 file(s) copied.

d:\data\u\nirsoft\1.23.37\NirSoft\x64>cd /d C:\data\rclone\scripts\exe 

C:\data\rclone\scripts\exe>passwordscan.exe
The system cannot execute the specified program.

C:\data\rclone\scripts\exe>passwordscan.upx.exe
<<< Process finished (PID=19200). (Exit code 0)

Rclone has been unblocked!

I got this reply from Microsoft:

I've updated my systems and it now works as it should.

Please all update our Defender signatures, disable the exceptions and report back if it doesn't work for you with a signature version equal to or greater than 1.347.597.

EDIT: It seems that Smartscreen has not yet been updated. If you download a new copy of rclone, you may still see a red warning screen.

5 Likes

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.