Windows Defender detects v1.15.1 as a trojan

[cactysman]

• I have read the FAQ.
• I have searched in existing issues.

Environment

• OS: Windows 10, 2004
• scrcpy version: v1.15.1
• installation method: Windows release

Describe the bug
Windows Defender claims this version of scrcpy contains Trojan:Win32/Emali.A!cl.

[ndinev]

Same problem

[rom1v]

Arf, this is the same problem as #1102 😞

Does it only block scrcpy-noconsole.exe, or also scrcpy.exe?
Is it only v1.15.1? Does it affects v1.15 or v1.14?

[rom1v]

Wow, Windows defender is triggered by v1.15.1 but not by 1.15:

• scrcpy-win64-v1.15.1.zip: https://www.virustotal.com/gui/file/78fba4caad6328016ea93219254b5df391f24224c519a2c8e3f070695b8b38ff/detection
• scrcpy-win64-v1.15.zip: https://www.virustotal.com/gui/file/dd514bb591e63ef4cd52a53c30f1153a28f59722d64690eb07bd017849edcba2/detection

The only source code difference between the two versions is: 9767619 and 633a51e 🤔

[Biswa96]

Windows Defender is mad. There are same issues in many repositories. Just allow it or disable it.

[cactysman]

Does it only block scrcpy-noconsole.exe, or also scrcpy.exe?

So far it only seems to complain about the -noconsole variant.

[SimonMarquis]

scrcpy.exe has been removed as well on my machine a few hours after scrcpy-noconsole.exe.

[quammy]

Hi, should be related -

Just got blocked by Chrome on trying to download, getting this message:
"scrcpy-win64-v1.15.1.zipFailed - Virus detected"

V1.15 did not triggered such a message.

Great tool and thanks for your effort!!

[rom1v]

Just got blocked by Chrome on trying to download, getting this message:
"scrcpy-win64-v1.15.1.zipFailed - Virus detected"

Yes, I guess it's Windows defender too:

https://windowsreport.com/failed-virus-detected-chrome/

So, you don’t have to blame Google Chrome but your own antivirus software as it is the one showing the Failed, virus detected alert message.

I'm not sure there is a simple way to report false positives (and make them confirm that the file does not contain a trojan).

[SimonMarquis]

@rom1v did you try to submit the binaries to Microsoft?

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/submission-guide

[quammy]

oh, ok. Just thought it can help in someway.
Anyway, with allowing it on Windows Defender I could make the download and work.
Thanks.

[rom1v]

Thank you for the link.

Can I submit a sample without signing in?

Yes, you many submit a file as an anonymous home customer. You will get a link to a webpage where you can view the status of the submission.

Contrary to what this page says, as soon as I click on submit, it requires to be logged with some account.

I just created an account and submitted "as a software developer" the file scrcpy-noconsole.exe.

[SimonMarquis]

Contrary to what this page says, as soon as I click on submit, it requires to be logged with some account.

Yeah, I experienced the same frustration... It might have been available when they first launched the portal.
Anyway, let's hope they can give us more info on why they flagged it, and maybe unflag it.

[AndroidDeveloperLB]

Is it ok to use v1.15.0 instead? Is it much of a difference ? I've noticed both were published very near each other...

[KeronCyst]

Can confirm:

[SimonMarquis]

Is it ok to use v1.15.0 instead? Is it much of a difference ? I've noticed both were published very near each other...

Here is the diff: v1.15...v1.15.1

v1.15.1 was a hotfix for #1643

[AndroidDeveloperLB]

@SimonMarquis Doesn't seem so important, no?

[cactysman]

It's probably Defender detecting some kind of evil in one of the SHA sums.
I don't know too much about antivirus though 🤔

[SimonMarquis]

@AndroidDeveloperLB no it doesn't seem that important and if v1.15 works for you, I guess you can keep it for now.
@metaa we'll see what the submission of the binary to Microsoft will tell us. 🤷

[rom1v]

For some reason, v1.16 is not detected as a trojan: https://www.virustotal.com/gui/file/3f30dc5db1a2f95c2b40a0f5de91ec1642d9f53799250a8c529bc882bc0918f0/detection

🎉

The problem is not "solved", but now that it seems ok with the latest release, I close this issue since it's a duplicate of #1102.

[rom1v]

I just created an account and submitted "as a software developer" the file scrcpy-noconsole.exe.

Analyst comments:

The submitted files do not meet our criteria for detection. No detection will be added for these files.

More detailed information about the approach and criteria categories currently used by the Microsoft researchers are available here:
https://www.microsoft.com/en-us/wdsi/antimalware-support/malware-and-unwanted-software-evaluation-criteria

Thank you for contacting Microsoft.

I'm not sure to understand why it does not meet their criteria. And in that report, they say "no malware detected" 🤔

[cactysman]

I'm not sure to understand why it does not meet their criteria. And in that report, they say "no malware detected" 🤔

Microsoft being Microsoft.
I think as long as it doesn't occur with the newer versions, we can safely drop this case.

[wgarrity-1]

@rom1v I rescanned the file through VirusTotal and it says no malware detected from Microsoft anymore, but it is still detected as malware with SecureAge APEX and Rising, but that is not a huge issue. https://www.virustotal.com/gui/file/d07c28b00f59281fc0db77c8ad10fc8f7d6effbd4371331068f62ce2188e6f07/detection

[AndroidDeveloperLB]

What does it mean "meet our criteria for detection" ?
There is a criteria to detect viruses?

[AzureRaptor]

The submitted files do not meet our criteria for detection. No detection will be added for these files.
More detailed information about the approach and criteria categories currently used by the Microsoft researchers are available here:
https://www.microsoft.com/en-us/wdsi/antimalware-support/malware-and-unwanted-software-evaluation-criteria
Thank you for contacting Microsoft.

I'm not sure to understand why it does not meet their criteria. And in that report, they say "no malware detected" 🤔

I believe what they mean is those files don't meet their criteria for detection as malware.

I'm guessing they don't maintain a "false positive signature" list, which is a little disappointing - or they do, and for whatever reason, they chose not to put scrcpy on it, which would be rather disturbing. I hope that is not actually the case.

[AndroidDeveloperLB]

But it's their AV app that reported it as such...
I don't understand.