Antivirus Removing Configure-Antivirus.ps1 Provisioner #5964

SignalRichard · 2022-07-25T16:34:10Z

SignalRichard
Jul 25, 2022

Hi,

I'm encountering a new error when trying to build images using this repo where the file "Configure-Antivirus.ps1" is locked and automatically removed by AV which breaks the Packer build because the file doesn't exist after starting execution. I've been using this repository for a long time, and this has not happened before (even as of last week)

Here is the output when attempting to get the file contents and my current Windows Defender AV information:

PS C:\Users\Richard\Sources\github\actions\virtual-environments\images\win\scripts\Installers> Get-Content -Raw -Path "Configure-Antivirus.ps1"
Get-Content: Operation did not complete successfully because the file contains a virus or potentially unwanted software. : 'C:\Users\Richard\Sources\github\actions\virtual-environments\images\win\scripts\Installers\Configure-Antivirus.ps1'

PS C:\Users\Richard\Sources\github\actions\virtual-environments\images\win\scripts\Installers> Get-MpComputerStatus

RunspaceId                       : ac515ebc-6966-46a3-bfd1-a4aee8559709
AMEngineVersion                  : 1.1.19400.3
AMProductVersion                 : 4.18.2205.7
AMRunningMode                    : Normal
AMServiceEnabled                 : True
AMServiceVersion                 : 4.18.2205.7
AntispywareEnabled               : True
AntispywareSignatureAge          : 0
AntispywareSignatureLastUpdated  : 7/25/2022 2:25:30 AM
AntispywareSignatureVersion      : 1.371.801.0
AntivirusEnabled                 : True
AntivirusSignatureAge            : 0
AntivirusSignatureLastUpdated    : 7/25/2022 2:25:30 AM
AntivirusSignatureVersion        : 1.371.801.0
BehaviorMonitorEnabled           : True
ComputerID                       : REDACTED-XXXX-XXXX-XXXX-XXXXXXXXXXXX
ComputerState                    : 0
DefenderSignaturesOutOfDate      : False
DeviceControlDefaultEnforcement  : Unknown
DeviceControlPoliciesLastUpdated : 7/25/2022 8:49:59 AM
DeviceControlState               : Disabled
FullScanAge                      : 4294967295
FullScanEndTime                  :
FullScanOverdue                  : False
FullScanRequired                 : False
FullScanSignatureVersion         :
FullScanStartTime                :
IoavProtectionEnabled            : True
IsTamperProtected                : True
IsVirtualMachine                 : False
LastFullScanSource               : 0
LastQuickScanSource              : 2
NISEnabled                       : True
NISEngineVersion                 : 1.1.19400.3
NISSignatureAge                  : 0
NISSignatureLastUpdated          : 7/25/2022 2:25:30 AM
NISSignatureVersion              : 1.371.801.0
OnAccessProtectionEnabled        : True
ProductStatus                    : 525312
QuickScanAge                     : 0
QuickScanEndTime                 : 7/25/2022 8:49:58 AM
QuickScanOverdue                 : False
QuickScanSignatureVersion        : 1.371.801.0
QuickScanStartTime               : 7/25/2022 8:48:55 AM
RealTimeProtectionEnabled        : True
RealTimeScanDirection            : 0
RebootRequired                   : False
TamperProtectionSource           : Signatures
TDTMode                          : cm
TDTStatus                        : Enabled
TDTTelemetry                     : Disabled
TroubleShootingDailyMaxQuota     :
TroubleShootingDailyQuotaLeft    :
TroubleShootingEndTime           :
TroubleShootingExpirationLeft    :
TroubleShootingMode              :
TroubleShootingModeSource        :
TroubleShootingQuotaResetTime    :
TroubleShootingStartTime         :

Is there a way to work around this without specially excluding this file/folder from AV? The issue I'm running into is when cloning this repository onto my build agents the file is deleted but I can't elevate permissions from within the build to exclude the file/folder from AV by using Add-MpPreference -ExclusionPath "..."