Downloading ZIP or TAR Windows reports Virus about formbuilder HOT 6 CLOSED

https://www.virustotal.com/gui/url/ca5e50d325d53c603fd6de2e92570d054c7d964aa787af1d17c0708970c4252b/detection passes the https://formbuilder.online/assets/js/form-builder.zip file too, including the Microsoft check. Unless someone can point to a specific file that is causing the issue this should be classified as a false detection of Microsoft Defender and not a bug here.

Submitting directly to Microsoft via https://www.microsoft.com/wdsi/filesubmission/ shows no detection

from formbuilder.

For those who come across this issue in the future. Reporting to Microsoft is the best step. Received the following response:

Analyst comments:

At this time, the submitted files do not meet our criteria for malware or potentially unwanted applications. The detection has been removed. Please follow the steps below to clear cached detections and obtain the latest malware definitions.

1. Open command prompt as administrator and change directory to c:\Program Files\Windows Defender
2. Run “MpCmdRun.exe -removedefinitions -dynamicsignatures”
3. Run "MpCmdRun.exe -SignatureUpdate"

Alternatively, the latest definition is available for download here: https://docs.microsoft.com/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus

from formbuilder.

Cannot replicate for current release

Clean https://www.virustotal.com/gui/file/e6311012100f2754621af534c3192a90e95bb412f436dff6279c397c458a9307/detection
Clean
https://www.virustotal.com/gui/file/9acc7b70771d51d4909466656c0b6faf054697bc2dd3bcaf9bf26e237dfd63f0/detection

Please report through whatever facility there is for Windows Defender for faulty detection

from formbuilder.

I can confirm that trying to download the compiled package via https://formbuilder.online/assets/js/form-builder.zip results in a virus detection notification. This occurs on Edge / Crome and is triggered by Windows Defender: Trojan:Script/Wacatax.B!ml

from formbuilder.

Thanks @TrueSpins
Its something in the .js files as I downloaded the TAR.GZ file also on my Ubuntu WSL2 and when trying to open the files, Windows defender removed them.

from formbuilder.

Thanks All.

I have downloaded again and now Windows defender is no longer picking the Zip and JS files as viruses..
Agreed to close this item.

Gary

from formbuilder.