Community

« Back to Antivirus issues

Portable Viewer flagged as Trojan: Win32/Rundas!plock

Links used in this discussion
Support level: Pro
I have the portable viewer on my work laptop (Win10 Pro) with Windows Defender. Today, all of a sudden, I couldn't launch the Viewer as it would close and disappear from my System Tray after double-clicking on it.  On a hunch, I checked Windows Defender, and sure enough there was a new detection, of the following virus: Trojan: Win32/Rundas!plock
https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=Trojan%3aWin32%2fRundas!plock&threatid=2147711527&enterprise=1

So now I'm unable to launch my Viewer, as the process gets killed right away. And for some reason, I'm unable to make an exception for it in Windows Defender, which may be a Group Policy in my corporate Windows 10.

This trojan has been around most of 2016, and most people claim it's a false positive, but being unable to add an exception for the Viewer exe in Defender, I'm stuck with no remote access.

Any suggestions?
Hello Bart,

Thank you for your message. Yes, this problem was also reported today by a few other users as well. We have already contacted Microsoft regarding this issue. Hopefully, they will fix it as soon as possible.

I perfectly understand your frustration because we are frustrated with these uncontrolled and irresponsible antivirus software behaviors too.

P.S. I will move this thread to the antivirus sub -forum.
Support level: Pro
Looks like the latest updates for Defender are allowing the Viewer to run in Windows 10.
Below is the current definition info:
Hello Bart,

This detection was strange from the very beginning. For example, when we tested it yesterday Windows Defender falsely notified as about this "trojan" but still allowed Viewer to run. Then why they call the Viewer a trojan in the first place? :)  

Anyway, we have already received a response from Microsoft and they asked some more information. We'll make sure that this issue is resolved soon.

Thanks.
Support level: Pro
And we're back to being blocked. Defender just updated a few minutes ago, and immediately it killed the Viewer process. So looks like whatever MS has done yesterday, they undid it today.



Hello Bart,

Yesterday they told us that they issued new definitions which they believed would fix the issue. It seems like the issue still persists.

We can but write to them again and kindly ask for removal of this detection. Thank you for letting us know.
Support level: Free or trial
Still doing it after an defender update this morning and a fresh download of RU

:(
Hello Ian,

We submitted a new request to Microsoft yesterday just as they instructed but so far no news from them.

Sorry for any inconvenience. By the way, perhaps it would speed up the process if you could submit a request too. It only takes a minute. Here is a link https://www.microsoft.com/en-us/security/portal/submission/submit.aspx

The file which is falsely detected is rutview.exe, it's the Viewer executable file. It can be found in C:\Program Files\Remote Utilities - Viewer\. You need to zip the file before uploading - the form doesn't allow files more than 10Mb to be attached.

Thanks.
Support level: Pro
It's working for me this morning, with the current definition updates:

Support level: Pro

Conrad wrote:

Sorry for any inconvenience. By the way, perhaps it would speed up the process if you could submit a request too. It only takes a minute. Here is a link  https://www.microsoft.com/en-us/security/portal/submission/submit.aspx  

The file which is falsely detected is rutview.exe, it's the Viewer executable file. It can be found in C:\Program Files\Remote Utilities - Viewer\. You need to zip the file before uploading - the form doesn't allow files more than 10Mb to be attached.

Thanks.

Report submitted:

Submission ID: MMPC17021010805743
Submitted date: Feb 10, 2017 17:38 PM UTC
Submit a reply

* Website time zone: America/New_York (UTC -4)