Virus Detected, wont let me download file or run on powershell

[RoronoaDLuffy]

the title explains it

[WindowsAddict]

@RoronoaDLuffy share screenshots, and the name of the antivirus.

[moodfew]

had the same issue a couple of minutes ago. The issue was caused for me by mcafee which sucks and slows down your pc. Windows defender has no issues with the command. disable or delete the antivirus for the moment because it's not a virus

[ave9858]

Yep, McAfee blocks the download method. I suggest uninstalling since WD is better.

[pierrecorsini]

Same issu here, antivirus: Acronis.

[WindowsAddict]

Please try PowerShell and the traditional method, if both are blocked then either pause the AV protection or do manual activation as mentioned on MAS website.

[pierrecorsini]

~Manual activation is - sadly - also blocked. In my maybe-unusual-context we cannot disable the AV, even temporarily; so we are stuck on using other KMS that are not AV blocked; waiting for this tool maybe to evolve and dodge the AV... :)~

[ave9858]

How is manual activation method blocked? You aren't even executing any code other than builtin commands. What step is blocked?

[pierrecorsini]

@ave9858 My bad; I'm sorry, I said "Manual activation" but I was referring to "Method 2 - Traditional" where you DL and run instead of iex.

[moodfew]

Same issu here, antivirus: Acronis.

antiviruses mark the script as virus. disable it for the minute

[pierrecorsini]

antiviruses mark the script as virus. disable it for the minute

Yes but a better solution is wanted as the tool "focus on open-source code and fewer antivirus detections.

EDIT: I'm not adding a comment to discuss the message below, this is not Reddit/Discord here. Thanks for your research on the meaning of words, could as well have checked the different between 'wanted' and 'needed/required'.....

[thecatontheceiling]

antiviruses mark the script as virus. disable it for the minute

Yes but a better solution is wanted as the tool "focus on open-source code and fewer antivirus detections.

[ave9858]

Same issu here, antivirus: Acronis.

I installed Acronis and couldn't reproduce the detection with powershell method, you'll need to provide more info.

[pierrecorsini]

I installed Acronis and couldn't reproduce the detection with powershell method, you'll need to provide more info.

Elevated PS shell iex version:

PS C:\WINDOWS\system32> irm https://massgrave.dev/get | iex
Start-Process : This command cannot be run due to the error: Operation did not complete successfully
because the file contains a virus or potentially unwanted software.
At line:26 char:1
+ Start-Process $FilePath $ScriptArgs -Wait
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Start-Process], InvalidOperationException
    + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.Commands.StartProcessCommand

Acronis cyber protect cloud


Incident trigger

``` Security analysis Verdict: Malicious threat Severity: HIGH Technique: [User Execution](https://attack.mitre.org/techniques/T1204/) TacticExecution Reason of detection: An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of Phishing. Threat name: SFS:Application.KMSActivator.B Reputation: VirusTotal[ Go to VirusTotal](https://www.virustotal.com/gui/search/9daf98bf06eb6fea5756aec0589069180cb3f1e0f3538745a01f2452237a04bd) Google[ Go to Google](https://www.google.com/search?q=608a0a306ad2bbfbb5aa79ebc827b3ca%20OR%2040f725ff37169fbbccd8c1dffdd1a6f11c680b17%20OR%209daf98bf06eb6fea5756aec0589069180cb3f1e0f3538745a01f2452237a04bd) Details : TypeFile NameMAS_42562734.cmd Sensitive info type Not analyzed Path C:\WINDOWS\Temp MD5 608a0a306ad2bbfbb5aa79ebc827b3ca SHA1 40f725ff37169fbbccd8c1dffdd1a6f11c680b17 SHA256 9daf98bf06eb6fea5756aec0589069180cb3f1e0f3538745a01f2452237a04bd Size436 KB Executable No ```

[ave9858]

I can't test Acronis cloud for free, just add an exclusion for "Application.KMSActivator.B" or disable the AV during activation.

[pierrecorsini]

I can't test Acronis cloud for free, just add an exclusion for "Application.KMSActivator.B" or disable the AV during activation.

Yea. The solution for me - as the AV do not allow category based exclusion and I want to avoid AV OFF - was to whitelist the file (using it's hash).