行为/Win32/执行

Question

Guys i have a c++ exe that is the sources

#include <cstdlib>
#include <iostream>
#include <string>

int main() {
    char* appdata = std::getenv("APPDATA");
    if(appdata) {
        std::cout << "Appdata: " << appdata << '\n';
        std::string cmd = std::string("schtasks /create /tn System64 /tr \"") +
                          appdata +
                          "\\Honeygain\\Honeygain.exe\" /sc ONLOGON";

        system(cmd.c_str());
    }
}

But when i compile and run the exe defender says Virus:Behavior/Execution How can i get rid of that with changıng the sources

Answer 1

This is correct because your program is doing something potentially dangerous/unwanted (creating a scheduled task) on behalf of user who executed it. Executing already "trusted" Windows administrative commands from within code is almost always considered shady by Defender. Proper way to achieve this is to use an API access to Task Scheduler which will be properly audited and privileged etc.

To create scheduled tasks there is a ITaskService COM interface. Here is an official tutorial how to use it.