Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Windows defender detects a trojan upon installation of 4.17.1 (false positive) #13335

Closed
1 of 3 tasks
UltimateLobster opened this issue Mar 25, 2023 · 119 comments
Closed
1 of 3 tasks

Windows defender detects a trojan upon installation of 4.17.1 (false positive) #13335

UltimateLobster opened this issue Mar 25, 2023 · 119 comments
Labels
lifecycle/locked

Comments

@UltimateLobster
Copy link

UltimateLobster commented Mar 25, 2023 •
edited
Loading

  • I have tried with the latest version of Docker Desktop
  • I have tried disabling enabled experimental features
  • I have uploaded Diagnostics
  • Diagnostics ID:

Actual behavior

Upon fresh instrallation I receive the folowing message:
Manifest extraction failed: Operation did not complete successfully because the file contains a virus or potentially unwanted software.

at CommunityInstaller.InstallWorkflow.d__30.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at CommunityInstaller.InstallWorkflow.d__23.MoveNext()

Windows defender than alerts me it has detected Trojan:Script/Wacatac.H!ml in the docker desktop temp folder

Expected behavior

The installation should go on smoothly

Information

  • Windows Version: 11 with the latest updates
  • Docker Desktop Version: 4.17.1
  • WSL2 or Hyper-V backend?
  • Are you running inside a virtualized Windows e.g. on a cloud server or a VM:

Output of & "C:\Program Files\Docker\Docker\resources\com.docker.diagnose.exe" check

Steps to reproduce the behavior

  1. ...
  2. ...
@alexvanbelle
Copy link

Same here. I updated Docker Desktop on another PC earlier this week and it was not detected as an issue by Defender.
However, considering the recent CVE of Docker desktop, I decided to update my personal laptop too and 4.17.0 & 4.17.1 were detected as threat by Microsoft Defender.

My guess is that Defender has new definition. Now, the point is to know if it's a false positive or whether Docker Desktop was compromised (supply chain attack?).

The threat detected is this one: Microsoft link.

I believe it's useless (because mainly random/temporary path but these are the path of threat detected:

  • 4.7.0: C:\Users\username\AppData\Local\Temp\DockerDesktop\54rr04zmhze
  • 4.7.1: C:\Users\username\AppData\Local\Temp\DockerDesktop\ntcimqv0mm2

Would be appreciated to know the actual status (false or true positive).

@BrandonKoerner
Copy link

Just tried installing Docker with the same issue.

@theking2
Copy link

theking2 commented Mar 25, 2023 •
edited
Loading

Workaround
In Windows Security under Virus & threat protection disable VIrus & threat protection settings.

image

@angieEncoded
Copy link

angieEncoded commented Mar 25, 2023 •
edited
Loading

Same here, 4.17.1 on Win10

Sure we can disable security as a 'workaround' (and it seems we have to leave it off or it wont run) - but until there is some confirmation that there isn't something actually wrong with this file that's not great advice. I went to an older version to do what I needed to do.

@morningscifi morningscifi mentioned this issue Mar 25, 2023
Open
@morningscifi
Copy link

Same here.

Windows 10 build 19045.2728

@theking2
Copy link

theking2 commented Mar 25, 2023 •
edited
Loading

Same here, 4.17.1 on Win10

Sure we can disable security as a 'workaround' (and it seems we have to leave it off or it wont run) - but until there is some confirmation that there isn't something actually wrong with this file that's not great advice. I went to an older version to do what I needed to do.

Thanks. Going back to an older version is not a solution either. It might even be more of a problem and security risk. After installation switch on the defender security and you are on par.

@dacchid
Copy link

dacchid commented Mar 25, 2023

Just tried installing Docker with the same issue. I agree going back to older version as well as disabling the virus threat protections are not good choices at all. Looking forward to getting this issue fixed.

@minervatheory
Copy link

is everyone else trying to replicate alpaca?

@Anonmalies
Copy link

Having the same issue here

explorer_sjclppH6U0

@Berehulia
Copy link

⬆️ Upvote

Same situation...

Can we receive any feedback, please?

@KemalMuharemovic
Copy link

KemalMuharemovic commented Mar 25, 2023 •
edited
Loading

Version 4.16.2, I tried versions that are above this version and I got the same error.
Until we get a better explanation this is the way to go I think.

@HugoMich
Copy link

Having a similar issue, I am going to assume that going to an older version might still be a security risk?

@lenellsarn
Copy link

4.17.0 does seem to have an important security fix https://docs.docker.com/desktop/release-notes/#security

@angieEncoded
Copy link

Thanks. Going back to an older version is not a solution either. It might even be more of a problem and security risk. After installation switch on the defender security and you are on par.

Agreed - it's not even close to ideal. I am having trouble with the older version anyway, it's moot. Just going to wait until this is addressed.

@SkittyWitty
Copy link

image
Same Issue here. First time installing Docker only to see that Windows Defender is detecting a Trojan.

@valdemart123
Copy link

Same for me
image

@GNUGradyn
Copy link

Any update on this?

@scyto
Copy link

scyto commented Mar 26, 2023 •
edited
Loading

i tried to submit the installer to Microsoft for a definitive positive/negative evaluation (if they find a file is safe they update definitions within hours)

unfortunately, the installer is too large to submit and it doesn't seem to be manually extractable to find the problematic file - unless someone knows how to extract the exe?

(my defender detected Backdoor:Win32/Bladabindi!ml)

@scyto scyto mentioned this issue Mar 26, 2023
Closed
@GNUGradyn
Copy link

Windows defender mentions the virus is Win32/Bladabindi!ml, which according to pretty much every source when you google this virus, claims it is a backdoor trojan. Hope docker didn't get hacked and we're just the first to notice

image

@scyto
Copy link

scyto commented Mar 26, 2023

Windows defender mentions the virus is Win32/Bladabindi!ml, which according to pretty much every source when you google this virus, claims it is a backdoor trojan. Hope docker didn't get hacked and we're just the first to notice

Every time i have ever had this happen to me, the file i submitted to MS turned out to be harmless - and they updated sigs, in one retro gaming forum a piece of software had been detected as malicious for years, a quick submission to MS fixed that in a couple of hours!

Unfortunately the limit is 500MB at https://www.microsoft.com/en-us/wdsi/filesubmission :-(

fingers crossed this is a false positive...

@Rik-Mukh
Copy link

Even I had the same issue. I'm using Windows 11 version 22H2 and am trying to install Docker version 4.17.1

@magicmq
Copy link

magicmq commented Mar 26, 2023 •
edited
Loading

It appears that for version 4.17.1 (latest), the checksum listed at https://docs.docker.com/desktop/release-notes/ does not match the checksum of the downloaded file. The download on the main page as well as the release notes page both have non-matching checksums.

I have not verified this myself but someone reported it on Reddit a couple of hours ago (on Windows 11 22H2) and a friend of mine has also verified that the checksums do not match ~30 minutes ago (on Windows 10). Thought it would be useful to contribute this info since it hasn't been previously mentioned.

@HugoMich
Copy link

It appears that for version 4.17.1 (latest), the checksum listed at https://docs.docker.com/desktop/release-notes/ does not match the checksum of the downloaded file. The download on the main page as well as the release notes page both have non-matching checksums.

I have not verified this myself but someone reported it on Reddit a couple of hours ago (on Windows 11 22H2) and a friend of mine has also verified that the checksums do not match ~30 minutes ago (on Windows 10). Thought it would be useful to contribute this info since it hasn't been previously mentioned.

Yup just verified this myself on Windows 11 22H2, the checksum of the installer for Version 4.17.1 does not match the one on the official Docker website. Just to check it out as well the Version 4.17.0 checksum does match though. Don't think this is any indication to use the older version, although it does include the fix for: (https://www.cve.org/cverecord?id=CVE-2023-0628 and https://www.cve.org/cverecord?id=CVE-2023-0629)

@HugoMich
Copy link

Interesting because @alexvanbelle reported getting the Defender warning on both 4.7.0 and 4.7.1

@Aplietexe
Copy link

Nothing on VirusTotal, but then again, Windows detects the trojan on install, not when downloading the file.

@yashasjindal
Copy link

It appears that for version 4.17.1 (latest), the checksum listed at https://docs.docker.com/desktop/release-notes/ does not match the checksum of the downloaded file. The download on the main page as well as the release notes page both have non-matching checksums.

I have not verified this myself but someone reported it on Reddit a couple of hours ago (on Windows 11 22H2) and a friend of mine has also verified that the checksums do not match ~30 minutes ago (on Windows 10). Thought it would be useful to contribute this info since it hasn't been previously mentioned.

I had the same error, after 10-20 tries at installation, I just allowed the installer to run from the defender->allow, then I read magicmq's comment about the checksums not matching and am rushing to uninstall with IObit uninstaller and running about 3-4 antivirus scans. Will update about any developments.

@realcanadrian
Copy link

Same malware detected when trying to install via Chocolatey package manager.

@alexvanbelle
Copy link

alexvanbelle commented Mar 26, 2023 •
edited
Loading

Interesting because @alexvanbelle reported getting the Defender warning on both 4.7.0 and 4.7.1

I guess it's just a typo but it's 4.17.0 & 4.17.1 (neither 4.7.0 nor 4.7.1)

To be clear:

  • I had an older version of Docker Desktop < 4.17.x. When I started Docker, it suggested to upgrade to 4.17.0. I then used the "auto update" (my main goal was to get rid of the CVE < 4.17). It failed with Defender warning and the error stack trace in the installer.
  • I decided to download by myself 4.17.1 and run the installer.

As the others, fingers crossed it's a false positive. I hope we'll get the confirmation soon.

@BrandonWanHuanSheng
Copy link

BrandonWanHuanSheng commented Mar 27, 2023 •
edited
Loading

It upgrade the Windows Security to 1.385.1239.0. It worked v4.7.1 for me

@komelgman
Copy link

komelgman commented Mar 27, 2023 •
edited
Loading

For manual update virus protection:
Windows Security -> Virus & threat protection -> Virus & threat protection updates -> Protection updates -> Check for updates

Then Docker Desktop installation will be successful

2023-03-27_13-27-17

@UnderShash
Copy link

I am latest version, still facing the issue.
image

@BrandonWanHuanSheng
Copy link

Sometimes the issue always can't be resolved.

@BrandonWanHuanSheng
Copy link

I got a real crash that docker application is hanging. The explorer was being killed. Microsoft Edge is not responding. The VMMAW keep using more memory.

@aldotapia
Copy link

Security Intelligence Version: 1.385.1251.0 also blocks Docker Desktop 4.17.1 (101757) installation

@hossnetapp
Copy link

Just go to the release notes and download v4.17.0. Windows defender is OK with this one!

@MihaelaStoica
Copy link

MihaelaStoica commented Mar 27, 2023 •
edited
Loading

Security Intelligence Version: 1.385.1251.0 also blocks Docker Desktop 4.17.1 (101757) installation

@aldotapia could you please let us know the Windows version where you've seen this happening?

BTW, the latest version of Defender is now 1.385.1261

@aldotapia
Copy link

@MihaelaStoica I'm using Windows 11, version 22H2.

Updated Windows Defender to 1.385.1272 and now I'm able to install Docker 4.71.1

@duonghungkiet
Copy link

image
I was updated Windows Defender then install successfully

@MihaelaStoica
Copy link

I am latest version, still facing the issue. image

@UnderShash could you please check if you still experience the issue with the latest Defender update. It is 1.385.1272 at the time of writing.

Also, @krzim and @robert-robinson-qubisoft, as you also experienced failures.

Your help in checking the latest update is most appreciated.

@tanyev
Copy link

tanyev commented Mar 27, 2023

Running 1.385.1272.0 Defender update. Docker Desktop 4.17.1 install failed. Version 4.17.0 install succeeded.

@shawnaxsom
Copy link

@tanyev It would be helpful to see what installation log files look like. You can try the diagnose tool post-install, or otherwise check C:\ProgramData\DockerDesktop\ for install-*.log files for any issues.

@tanyev
Copy link

tanyev commented Mar 27, 2023

It seems to mirror the screenshot provided by: #13335 (comment) but with more detail.

install-log-admin.txt

@GuiNSilva
Copy link

Yesterday I had the same problem, today I decided to run the installer as admin and there were no problems, it installed normally.
Docker

@robert-robinson-qubisoft
Copy link

@BrandonWanHuanSheng
Copy link

My Docker Setup keep hanging while during installation. The docker hang the setup and click on two time to become white screen and the setup start to install Docker Desktop. After install, docker did not start the service. I kill all the docker application. Because the background process is still using on it. Later on, I restart the docker service.
20230328114249.zip
Diagnose.log
Gather.log

@BrandonWanHuanSheng
Copy link

Diagnose ID: 1C363CDE-2301-4049-873A-B50B7D10B243/20230328115143

@MihaelaStoica
Copy link

@robert-robinson-qubisoft, thanks for confirming that the in-app update from 4.16.3 to 4.17.1 does not trigger the Defender

@MihaelaStoica
Copy link

MihaelaStoica commented Mar 28, 2023 •
edited
Loading

My Docker Setup keep hanging while during installation. The docker hang the setup and click on two time to become white screen and the setup start to install Docker Desktop. After install, docker did not start the service. I kill all the docker application. Because the background process is still using on it. Later on, I restart the docker service. 20230328114249.zip Diagnose.log Gather.log

@BrandonWanHuanSheng the issue you describe is different from the one discussed on this thread. In the effort of keeping the discussion relevant, could you please open a new issue for this?

@tanyev
Copy link

tanyev commented Mar 28, 2023

With defender definitions 1.385.1360.0 I was able to install version 4.17.1 (over version 4.17.0) w/o the trojan complaint. I did not have to run as administrator. Nor did I use Docker Desktop's own update facility. I just double-clicked the installer.

@BrandonWanHuanSheng
Copy link

BrandonWanHuanSheng commented Mar 28, 2023 •
edited
Loading

It also work for me. v4.17.1 and v4.17.0 is installable. Trojan and Backdoor suppose to be gone. But I am unsure if I apply dynamic update to resolve this issue. I am going to under a restart windows update back with the dynamic update. This is a sign of missing security dynamic update on the PC.

@BrandonWanHuanSheng
Copy link

BrandonWanHuanSheng commented Mar 28, 2023 •
edited
Loading

This might be able fix to the installation
https://catalog.s.download.windowsupdate.com/d/msdownload/update/software/secu/2023/03/windows10.0-kb5023696-x64_a1b375cef5675118fdb710166bcc30d59aa287cd.cab This also have a security patches. What it will happen?

@BrandonWanHuanSheng
Copy link

It also allow me to 4.6.2 as well.

@BrandonWanHuanSheng
Copy link

BrandonWanHuanSheng commented Mar 29, 2023 •
edited
Loading

Normally, this dynamic update can fix some critical issue. But you unable to receive them for Windows Update. You should go to the catalog to download the installer.
Windows 10 22H2 x86
https://catalog.s.download.windowsupdate.com/c/msdownload/update/software/secu/2023/03/windows10.0-kb5023696-x86_b250df03e7af1fe87d67a587b2c45c304e180f19.cab
Windows 10 22H2 x64
https://catalog.s.download.windowsupdate.com/d/msdownload/update/software/secu/2023/03/windows10.0-kb5023696-x64_a1b375cef5675118fdb710166bcc30d59aa287cd.cab
Windows 10 22H2 ARM64
https://catalog.s.download.windowsupdate.com/c/msdownload/update/software/secu/2023/03/windows10.0-kb5023696-arm64_d1b9357584033ca5d46560a49af7c9f35a99f06b.cab
Windows 11 22H2 x64
https://catalog.s.download.windowsupdate.com/c/msdownload/update/software/secu/2023/03/windows11.0-kb5023706-x64_607f551746c4de8354cf68640a9d3577a19277b3.cab
Windows 11 ARM64
https://catalog.s.download.windowsupdate.com/c/msdownload/update/software/secu/2023/03/windows11.0-kb5023706-arm64_472b66409cb76cd58b53b814545440d3fdfdbfb8.cab
Remember, you need to following the system architecture to install this update. I just display some recent version using windows. If you want to search previous version windows, you can go to the Microsoft Update Catalog to search for dynamic update. www.catalog.update.microsoft.com This one is called the windows patch update to resolves some important security issue.

@shawnaxsom
Copy link

We've released Docker Desktop v4.18.0 yesterday, which has never been flagged with an assumed false positive.

We've also been unable to reproduce within newer definitions of Windows Defender with Docker Desktop v4.17.0 and v4.17.1.

I'll close this issue for now. Please let us know if you do experience the assumed false positive flagging in the future, feel free to reopen if experienced with these versions (or open a new GitHub Issue if it's with a newer version or different reported trojan than "Trojan:Script/Wacatac.H!ml" and "Trojan:MSIL/Bladabindi!MTB").

@docker-robott
Copy link
Collaborator

Closed issues are locked after 30 days of inactivity.
This helps our team focus on active issues.

If you have found a problem that seems similar to this, please open a new issue.

/lifecycle locked

@docker docker locked and limited conversation to collaborators May 6, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
lifecycle/locked
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests