Installer for windows being blocked by Defender, "Trojan:Win32/Zpevdo.B"

SpaceMan013 · June 20, 2021, 11:53am

I tried installing the software on windows from the official github page but found this trojan warning, install was blocked automatically. On searching up this trojan, I found it was associated with granting unauthorized access across Windows Firewall. Please clarify whether this is an intended feature of the Activity watcher or the github installer link has somehow been compromised.

EDIT: This is a new flag, previous questions regarding similar security warning have had a different warning.

Also, from what I can gather from previous replies, it is related to the keylogger function in the software. I hope there is an option to disable keylogging in ActivityWatch

johan-bjareholt · June 27, 2021, 5:06pm

Yes this is intended behavior, we use the port 5600 for the web-ui and for our watchers to connect to the server. The port is only exposed to the localhost so it is secure, but windows defender can’t know that until you run the program so it’s only option is to mark it unsafe.

ErikBjare · July 5, 2021, 10:15am

Also see this issue for details on past false-positives by antivirus systems:

github.com/ActivityWatch/activitywatch

Submit false positives to antivirus vendors

opened 03:10PM - 21 Mar 18 UTC

az0

help wanted improves: security

I saw in past issues (e.g., #140 ) that people reported that the software is fl…agged by antivirus software, and that this is reasonable estimate based on the heuristic of a keylogger. The latest Windows zip is [flagged by 9 scanners](https://www.virustotal.com/#/file/320a3ed29ee87fa9de5b497f396f597ce51b74d91a5bbb9673d68ad5b7cbdb8b/detection). Would you please consider contacting the vendors to whitelist it? There is a contact list on [techsupportalert](https://www.techsupportalert.com/content/how-report-malware-or-false-positives-multiple-antivirus-vendors.htm) and another list is available if you email VirusTotal.

Also, from what I can gather from previous replies, it is related to the keylogger function in the software. I hope there is an option to disable keylogging in ActivityWatch

We no longer use a keylogging-like approach on Windows to detect activity anymore, instead we use Windows APIs to detect if there’s been any user input or not (no keys directly listened to), so this shouldn’t be an issue.