search

pwntester / ysoserial.net

Deserialization payload generator for a variety of .NET formatters
MIT License
3.24k stars 474 forks source link

the file contains a virus or potentially unwanted softwareAt #169

Open 61ax opened 2 months ago

61ax commented 2 months ago

Program 'ysoserial.exe' failed to run: Operation did not complete successfully because the file contains a virus or potentially unwanted softwareAt line:1 char:1

windows security :: Detected:VirTool:MSIL/Vusrlize.A!MTB

Affected items: file: C:\Users\folder\ysoserial.net\ysoserial\bin\Release\ysoserial.exe

rkg-mm commented 3 weeks ago

Can confirm our anti-virus also flagging this as Trojan

irsdl commented 3 weeks ago

Hey everyone,

This is not a trojan; rather, YSOSerial.Net is a legitimate security tool created for ethical testing by security professionals. It includes payloads for exploiting deserialization vulnerabilities in the .NET Framework/Mono. Antivirus programs often detect these embedded payload strings and flag them as potential threats because they resemble code patterns used in actual exploits.

If you're seeing this alert outside of a security testing context, it could indicate a compromise on your system. However, if you're a security professional using this tool intentionally, you likely understand the detection and can work around it by either excluding it in your antivirus settings or compiling a custom version to avoid generic string detection.

I’m providing this explanation in case you're not familiar with security testing tools. Unfortunately, we’re unable to discuss methods for bypassing antivirus detections in detail for security reasons. I hope this clears things up.