Active RMA quarantined as Trojan by Windows Defender

Ben · Post by **Ben** » Tue Dec 14, 2021 11:03 am

Title says it all, RMA is 7.64.

Event viewer says:

Antivirus Microsoft Defender a dÃ©tectÃ© un logiciel malveillant ou potentiellement indÃ©sirable.
Pour plus dâ€™informations, reportez-vous aux Ã©lÃ©ments suivants :
https://go.microsoft.com/fwlink/?linkid ... terprise=0
Nom : Trojan:Win32/Injector.RPZ!MTB
ID : 2147807732
GravitÃ© : Grave
CatÃ©gorie : Cheval de Troie
Chemin : process:_pid:4796,ProcessStart:132839746935600679
Origine de la dÃ©tection : Inconnu
Type de dÃ©tection : Concret
Source de dÃ©tection : SystÃ¨me
Utilisateur : AUTORITE NT\SystÃ¨me
Nom du processus : C:\Program Files (x86)\HostMonitor\RMA-Win\rma_active.exe
Version de la veille de sÃ©curitÃ© : AV: 1.355.247.0, AS: 1.355.247.0, NIS: 1.355.247.0
Version du moteur : AM: 1.1.18800.4, NIS: 1.1.18800.4

We think it's since server got update KB2267602.

KS-Soft · Post by **KS-Soft** » Tue Dec 14, 2021 1:19 pm

We cannot reproduce the problem on our systems and we cannot fix Defender.
We checked using the same Defender definition version: 1.355.247.0

What Windows do you use?

Regards
Alex

Ben · Post by **Ben** » Wed Dec 15, 2021 2:52 am

I have still yet to consolidate data events but it seems to be happening only on 2016 and 2019 servers.

I'm checking 2012 ones rn.

itelio · Post by **itelio** » Wed Dec 15, 2021 3:21 am

Hi there,

I also had the same problem with a customer. Here the Windows Defender update has classified the rma_active.exe process as a threat and terminated it continuously. Putting the process on the exception list helped.

System: Windows10 Pro 21H1

It has occurred since the pattern update was played.
Installation successful: The following update has been installed. Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.355.269.0)

bmekler · Post by **bmekler** » Wed Dec 15, 2021 3:47 am

I also have it happening on numerous machines, Windows Defender is identifying RMA as 'Trojan:Win32/Injector.RPZ!MTB'

https://www.microsoft.com/en-us/wdsi/th ... 2147807732

Ben · Post by **Ben** » Wed Dec 15, 2021 4:35 am

We momentary treated the issue by launching this command on each concerned server:

Code: Select all

powershell.exe -command Set-MpPreference -ExclusionPath 'C:\Program Files (x86)\HostMonitor\RMA-Win\rma_active.exe'
net start ActiveRMAService

It just adds the rma exe to exclusions in windows defender then start the service again.

KS-Soft · Post by **KS-Soft** » Wed Dec 15, 2021 7:11 am

Today Microsoft updated Defender definitions, should work fine after system update:
open command prompt as administrator and run
---------
cd c:\Program Files\Windows Defender
MpCmdRun.exe -removedefinitions -dynamicsignatures
MpCmdRun.exe -SignatureUpdate
---------

Regards
Alex

Ben · Post by **Ben** » Wed Dec 15, 2021 7:53 am

Thanks for your return.

Did apply it on two servers, it works, but if rma was quarantined you still have to autorize it. I did it manually.

Rma is not flagged by windows defender anymore.

KS-Soft · Post by **KS-Soft** » Wed Dec 15, 2021 8:26 am

Also make sure Defender does not check HostMonitor log and report files, sometimes it uses a lot of system resources.

Regards
Alex

Active RMA quarantined as Trojan by Windows Defender

Active RMA quarantined as Trojan by Windows Defender

Problems with Defender and RMA Process