Rdpwrap: v1.6.2 is showing viruses/trojans by several virus scanners
15/58 virus scanners are showing malware in this package. In v1.6, they also showed 5/58. Something shady is going on with this package. See virus scanning results here:
Some of these look like they are specifically detecting rdpwrap, but some look like they are detecting WisdomEyes and other malware.
Also, the latest version of Chrome on Windows refuses to download v1.6.1 saying that it is "dangerous". It does download v1.6 just fine though.
signal15
All 41 comments
Well, maybe if I change the behaviour of installer not to enable RDP by default after installation, it will be more secure, and those AVs would be more quiet.
binarymaster
on 10 Jul 2017
It’s the behavior of the installer that is triggering the problem. The installer is a newly installed program that goes and download an INI or DLL, right? (Or anything over TLS.) Well, that is malicious behavior (at least that is how antivirus vendors see it). Digitally sign the installer with a code signing certificate. Then you can contact reach antivirus vendor individually and request that your signature is added to a whitelist.
Alternatively: don’t download stuff off the web right away. Do auto-update like behavior and wait a week before you start downloading resources. This require that everything is bundled in the installer, however.
da2x
on 10 Jul 2017
Why not just package the DLLs/INIs with the installer instead of having them downloaded when the installer is run?
In any case, I cannot even get v1.6.1 to download via Chrome, and if I download with another browser, our corporate AV solution flags it and deletes it, and then a ticket gets opened and an investigation is launched. I can have them whitelist the hash, but that would require at least a couple of hours of someone's time to verify in a sandbox that the tool is safe. I'm sure many others are facing the same issues as I am.
signal15
on 10 Jul 2017
Why not just package the DLLs/INIs with the installer instead of having them downloaded when the installer is run?
They are already built-in. Online installation is optional feature and controlled by command-line arguments.
binarymaster
on 10 Jul 2017
If you made enabling RDP a checkbox option, I wonder if that would get around some of it as well.
signal15
on 10 Jul 2017
//edit:nvm, sorry for triggering notifications - i totally missed that it is mentioned in the last sentence of the first post.
_Also flagged by Current Stable Chome on Windows as malware/malicious download. Maybe you can file a
request here https://support.google.com/webmasters/answer/3258249?hl=en_
The1andONLYdave
on 19 Jul 2017
(There are no exception for unsigned programs … it’s the certificate that is excluded not the software.)
da2x
on 19 Jul 2017
Any update on this? Chrome is still blocking the download.
psommerfeld
on 19 Sep 2017
In chrome after download refuses to start click the "Show All" and there click "keep anyway".
maxim
on 28 Sep 2017
So, when downloading 1.6.1, Chrome blocked it. However, I went to Settings >> Downloads and was able to get Chrome to download it. However, when I tried to install it, my Malware detector, Bitdefender, also blocked it. Can you confirm that the download and install is safe?
goozleology
on 4 Oct 2017
Can you confirm that the download and install is safe?
How I can do it? It's a matter of trust, since you're downloading it from official repo ( https://github.com/stascorp/rdpwrap/releases ).
If you don't trust the binaries, you'll need to build it from source. If you don't trust the code, I don't know how to help you.
binarymaster
on 4 Oct 2017
@binarymaster you can provide a sha256sum or better still, you can provide a .sig file using a GPG key? And provide your GPG key's fingerprint for verification. There are still trust issues, but if you establish a good reputation with a GPG key, then it can be very much worthwhile. You can also create an account as keybase.io and verify your Github account through that, as well as verify your GPG key; then provide details of your fully verified keybase.io account.
affinityv
on 4 Oct 2017
@binarymaster you can provide a sha256sum or better still, you can provide a .sig file using a GPG key? And provide your GPG key's fingerprint for verification. There are still trust issues, but if you establish a good reputation with a GPG key, then it can be very much worthwhile. You can also create an account at keybase.io and verify your Github account through that, as well as verify your GPG key; then provide details of your fully verified keybase.io account.
affinityv
on 4 Oct 2017
Are you having trouble with GPG?
Or maybe you are worry that taking rdpwrap off the malware list will make you a riper target for the M$ legal department?
distinguished-git
on 15 Dec 2017
@distinguished-git unfortunately I have no free time to work on that.
binarymaster
on 15 Dec 2017
The latest version has triggered even more virus alerts on Total Virus. It has now risen from 15 to 19 with some of the most commonly installed AV suites blocking RDP Wrapper including, as said above, Google Chrome. It is a superb utility and we need to assist binarymaster in getting it in a format that does not trigger such serious trojan and malware warnings.
BigMikeC
on 29 Dec 2017
Just for curiosity's sake I rechecked all binaries in release, here are results:
- RDPWInst.exe: 5/67
- RDPConf.exe: 8/66
- RDPCheck.exe: 18/67 most unlucky, however community score is +5
binarymaster
on 1 Jan 2018
The problem is! Binarymaster, is that those 18 anti malware scanners are amongst the most popular products and it leaves a huge number of users unable to install the files or try to create a quarantine exceptuin
BigMikeC
on 3 Jan 2018
huge number of users unable to install the files or try to create a quarantine exception
Since the project is targeted at system administrators and experienced users, this is not so huge.
binarymaster
on 3 Jan 2018
Honestly, what people concerned about this can do is report the detection to the AV vendors as false positives. Here is my pretty successful try with Kaspersky (that I'm using personally as AV):
YisroelTech
on 4 Jan 2018
I think the issue is the virus scanners you are using. Where is the virus binarymaster snuck in? go look at the source code that he has kindly provided and show it to me! most of the complainers are just trying to get hits on the search engines so people will stop using this. who do these complainers work for? Microsoft or an affiliate? I have personally downloaded and compiled the source, which is how I am using this package. if you are concerned then do it that way. binarymaster is not getting paid!
asulwer
on 8 Jan 2018
@asulwer, stop accusing people as working for someone etc...
People aren't "complaining" they are just "asking" if there's a possibility to have this assume tool being more easy to use for the layman who isn't proficient in excluding or bypassing their AV.
But as binarymaster correctly pointed out, this project is targeted for experienced users and it'll take too long for him to work on this issue.
But the community can certainly try to help by reporting this as a False Positive to the AV vendors.
YisroelTech
on 8 Jan 2018
To confirm what Asulwer just stated. Nobody is complaining and we all agree its a superb utility. We also all agree that the Virus scanners (18 out of 66 of them) are being far too sensitive to some aspect of the program and generating a false positive. Those 18 are some of the main anti-virus programs. The idea is to see if we can assist by either flagging it as false positive with each individual software provider or helping with another apsect in the coding or dll's.
BigMikeC
on 8 Jan 2018
Some news: I've contacted Dr. Web support manager to resolve false positive alert from their product, and they answered me that problem is solved now (I hope so).
binarymaster
on 19 Jun 2018
PMFJI: I can install v1.6.1 with GData Scanner active (and run update.bat) but can't install v.1.6.2 as is it recognized as malware.
I'd be glad for an official whitelisting by GData.
Michael
guebert
on 17 Jul 2018
My computer was inflected cyssis ransomeware after installed this
hkvega01
on 19 Sep 2018
@hkvega01 don't download stuff from third party sites.
binarymaster
on 19 Sep 2018
I downloaded directly from the GitHub page. I understand the confusion when it comes to antivirus and malware detection, but what about popups the next day?
They included:
Threat: | HKTL_RADMIN
-- | --
Source: | Spyware
Affected Files: | C:\WINDOWS\Installer\43fb44.msi
HKTL_RADMIN
Threat: | HKTL_RADMIN
-- | --
Source: | Spyware
Affected Files: | C:\Users\salmm\D…8-1f0acd3cf0d6.tmp
Threat: | HKTL_RADMIN
-- | --
Source: | Spyware
Affected Files: | C:\Users\salmm\D…-ffba838dbd0a.tmp
Threat: | HKTL_RADMIN
-- | --
Source: | Spyware
Affected Files: | C:\Users\salmm\D…-ec11e3e946ec.tmp
salmmm22
on 7 Oct 2018
First of all I'd like to say thank you for creating and maintaining this. I come from the Mac/Linux side of computing and hadn't touched a Windows machine in probably a decade. The software works great but the warnings really had me checking the links multiple times to make sure that I don't download something that will mess with my server.
In order to combat this and appear a bit more credible I'd like to see everything code signed and SHA256 hashes published alongside the downloads. That way one can easily verify the downloads and those tasks can be automated.
I understand that this is overhead and you may not have time to do it right now but it may be a good way to indicate that this software isn't malware.
Thanks again and hope that you'll find a solution that works for you 👍
tzeejay
on 5 Nov 2018
Here is a friendly reminder for those like @hkvega01 (and myself) landing on this page, the software itself is alright. Here is an article that roughly matches the timeline https://www.zdnet.com/article/fbi-warns-companies-about-hackers-increasingly-abusing-rdp-connections/ . Long story short. Have strong passwords and limit allowed IPs with firewalls and such. Changing default port is not a solution!
mlt
on 16 Feb 2019
Problem is we really can't trust that you have verified that you haven't been hacked or something. You really need to get this fixed or give it up. No developer should ask people to just trust that there is no virus...
bunchp
on 18 Apr 2019
I'm blocked by chrome also. I would build this myself, I've been a developer for years, but I don't find any instructions in the website. It appears to be written using Pascal - I have no experience with pascal, that renders me a noob. How about some build instructions - does anyone have those?
darkoverlordofdata
on 20 Apr 2019
Ah - I missed this:
Building the binaries:
x86 Delphi version can be built with Embarcadero RAD Studio 2010
x86/x64 C++ version can be built with Microsoft Visual Studio 2013
the only issue there, is those cost more then the windiws 10 home upgrade that this replaces...
given the long list of open issues with this software, that doesn't sound like a good idea. Guess I'll just pay my money to Microsoft and get the real thing.
darkoverlordofdata
on 20 Apr 2019
Everyone blocked by Chrome, stop using spyware browser! Download direct with wget or with a better browser.
affinityv
on 21 Apr 2019
@asulwer, stop accusing people as working for someone etc...
I don't work for someone - McAffee just flagged it.
Saying that doesn't help - and it's inaccurate.
I'll try sending to McAfee as a false positive - that's what we pay them for - not circumventing their input - they need to get it right, or binary master needs to sign it properly or get it to behave in a way AVs will tolerate.
onebod
on 9 Jun 2019
Is there a solution/work around to being able to get RDPConf.exe to stay on a machine...McAfee keeps removing it as a 'virus'
jas-glitch
on 18 Oct 2019
@jas-glitch All anti-viruses have an exception list. Add RDPConf.exe to that list.
cowwoc
on 18 Oct 2019
@jas-glitch All anti-viruses have an exception list. Add
RDPConf.exeto that list.
thanks, unfortunately, we are part of a much bigger governing body, so this will not happen :(. thats o, I'll keep a zipped version of it somewhere as I only use it when RDPWrapper breaks, and see if i can run it enough to see what the problem is...otherwise, I'll just have to work through itmanually
jas-glitch
on 18 Oct 2019
Similarly, Firefox warning "This file contains a virus or malware".
EDIT: Antivirus apps (and Firefox) detecting this as a virus maybe due to the fact it has been used by attackers https://news.softpedia.com/news/danabot-banking-trojan-moves-to-europe-adds-rdp-and-64-bit-support-522842.shtml . I remember when many of nirsoft's apps were reported as "viruses" I assume for the same reason.
BTW, someone opened _another_ ticket 2 hrs ago, #1047
daveybops
on 7 Apr 2020
In all fairness, while we can blame non-Microsoft AV, even Microsoft labels components of RDPwrapper as SEVERE with regards to risk. While I would like to see Microsoft spend more time vetting their (bad) patches to Windows 10, Microsoft instead has made the elimination of RDP Wrapper their chief priority. Personally, I'd get this project out of github (the new strong arm of Microsoft's empire).
Microsoft labels RDP Wrapper at the top of high risk software you might have installed on your computer.
ntlug
on 25 Aug 2020
@ntlug -- Not my quote....
"....exposure to Windows causes brain damage and that its use in the corporate workplace should be considered an OSHA violation."
I would extend that to other Microsoft property and I too would love to see projects exiting Github to a property owned by an actual and real supporter of open source.
The quote come from this debian-user thread:
https://lists.debian.org/debian-user/2020/08/msg00714.html
affinityv
on 26 Aug 2020
Related issues
isidorosss
·
5Comments
eyeTechSolutions
·
5Comments
mahmoodyali
·
4Comments
francescofalanga92
·
3Comments
eduardolucioac
·
4Comments
Most helpful comment
First of all I'd like to say thank you for creating and maintaining this. I come from the Mac/Linux side of computing and hadn't touched a Windows machine in probably a decade. The software works great but the warnings really had me checking the links multiple times to make sure that I don't download something that will mess with my server.
In order to combat this and appear a bit more credible I'd like to see everything code signed and SHA256 hashes published alongside the downloads. That way one can easily verify the downloads and those tasks can be automated.
I understand that this is overhead and you may not have time to do it right now but it may be a good way to indicate that this software isn't malware.
Thanks again and hope that you'll find a solution that works for you 👍