You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Windows Defender flags test assembly as ransomware #747
Cloning (commit cefdc20) and building with no changes results in Renci.SshNet.Tests.dll being flagged as ransomware (Ransom:MSIL/Hasadcrypt.A). Does anyone have an idea what portion of the code could be suspect?
System info: Windows 10 Enterprise version 10.0.19042 Build 19042
On Dec 2, 2020, at 5:31 PM, Sam Freed ***@***.***> wrote:
Cloning (commit cefdc20 <cefdc20>) and building with no changes results in Renci.SshNet.Tests.dll being flagged as ransomware (Ransom:MSIL/Hasadcrypt.A). Does anyone have an idea what portion of the code could be suspect?
System info: Windows 10 Enterprise version 10.0.19042 Build 19042
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub <#747>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAD7IHTAQKIZZRLSMOVH6LDSS2W2NANCNFSM4ULCHDJA>.
Unfortunately it's still the case.
Today my Defender flagged Renci.SshNet.Tests.dll as MSIL/Hasadcrypt.A for all targets (.NET Framework and NET Core).
On the other hand this does not seem like a Microsoft Defender only issue - on VirusTotal 16/69 engines flags it as Malicious.
Activity
darkoperator commentedon Dec 2, 2020
sfreed141 commentedon Dec 2, 2020
Reported to MS. Btw the file that is causing the issue is https://github.com/sshnet/SSH.NET/blob/develop/src/Renci.SshNet.Tests/Classes/PrivateKeyFileTest.cs. If I remove it from the build I can build and run tests fine.
bad-samaritan commentedon May 16, 2021
Unfortunately it's still the case.
Today my Defender flagged Renci.SshNet.Tests.dll as MSIL/Hasadcrypt.A for all targets (.NET Framework and NET Core).
On the other hand this does not seem like a Microsoft Defender only issue - on VirusTotal 16/69 engines flags it as Malicious.
zybexXL commentedon Aug 26, 2021
Still the same today for me, just for target NET4.0 in Debug profile.
zybexXL commentedon Sep 1, 2021
Fixed with PR #867
IgorMilavec commentedon Feb 13, 2022
Duplicate of #737