Trojan on Installer

[djlf 40]

Guys, Emby sever wouldnt load with windows defender detecting malware after install of latest stale release.

Defender picked up Trojan:Win32/Fethar.B!cl , which it quarantined but server wouldnt start.

After switching defender off, emby installed ok and ran ok. Turn defender on and same result as above.

Is this a false positive? or something to worry about?

 

[Happy2Play 9783]

Yes it would be a false positive, wonder why I haven't seen this on the three machines I have Server on, only running Defender.

[djlf 40]

ran malwarebytes and it found nothing. Strange ????

[Happy2Play 9783]

ESET/NOD32 and Avast are causing browser issue also so something is going on.

[Luke 42082]

at what stage exactly did this happen?

[djlf 40]

Just after emby installed. i did a fresh install from website because my auto organise was playing up.

When i clicked on app it wouldnt start. So installed again at the end of which defender kicked in saying

it found malware which is the trojan. I restored it from quarantine and allowed it - now emby runs fine.

[Happy2Play 9783]

So this was a reinstall over an existing install or a new install, not that is should matter.

[djlf 40]

Reinstall over existing install . Did it 3 times to be sure. Each time defender found malware Trojan as described

[Luke 42082]

when this happened what emby windows were on screen?

[Happy2Play 9783]

Can you post the version of Defender also.

 

Can't reproduce on my machine

[THX.1138 0]

Installed Emby for the first time ever. Got a Defende popup about a trojan in mediabrowser.serverapplication.exe.  See screenshot.

Proces:

Installed Emby completely. The screen to configure Emby opened in browser. I waited a couple of minutes and got a popup.

 

Please advise.

[steveBCN 1]

I'm getting exactly the same issue. Latest automatic server update triggers Windows Defender which removes it citing the same trojan mentioned above.

[Luke 42082]

Since we can't reproduce, if you could do some testing of running the beta installer that would be very helpful. I've gone back to just embedding ffmpeg into the application rather than having it download on first run. I think it is the downloading of ffmpeg that is often triggering a false positive. Thanks.