Powershell: dotnet apphost.exe detected as Trojan

[jazzdelightsme]

Steps to reproduce

I cloned the repo, and executed:

Import-Module .\build.psm1
Start-PSBootstrap

Expected behavior

Everything works great.

Actual behavior

Popup from Windows Defender, claiming that this file:

C:\Users\<me>\AppData\Local\Microsoft\dotnet\packs\Microsoft.NETCore.App.Host.win-x86\5.0.0\runtimes\win-x86\native\apphost.exe

Is a virus: Trojan:Win32/Fuery.C!cl

[iSazonov]

I wonder to see the report in the repository. It is better to report the false positive to Windows Defender team.

[iSazonov]

If you think it is not false positive please use out security template as guidance to create a security report.

[jazzdelightsme]

Submitted to Defender people following instructions here: https://www.microsoft.com/en-us/wdsi/filesubmission/.

Submit a file for malware analysis - Microsoft Security Intelligence

Submit suspected malware or incorrectly detected files for analysis. Submitted files will be added to or removed from antimalware definitions based on the analysis results.

[iSazonov]

/cc @TravisEz13 for information.

[jazzdelightsme]

This has been addressed. Steps to fix locally:

1. Open command prompt as administrator and change directory to c:\Program Files\Windows Defender
2. Run “MpCmdRun.exe -removedefinitions -dynamicsignatures”
3. Run "MpCmdRun.exe -SignatureUpdate"

Alternatively, the latest definition is available for download here: https://www.microsoft.com/en-us/wdsi/definitions

Latest security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware - Microsoft Security Intelligence

Download the latest security intelligence updates for Microsoft Defender Antivirus, Microsoft Security Essentials (MSE), System Center Endpoint Protection (SCEP) and other antimalware.