Rovodev Malware alert

[James Bylett]

One of our Devs is trying to test out Rovodev, but is running into the issue Microsoft Defender is claiming that atlassian_cli_rovodev.exe is a Bearfoos Malware. Has anyone else encountered this issue? Is this verified as a false positive or is there something underlying that needs to be changed to prevent this issue?

[Hans Polder · Accepted solution]

Hi James,

I have not worked with Rovodev myself.

If you get stuck, please report here - I have triggered a button to make sure that someone from Atlassian Support joins in here to check if they can help you. 

[James Bylett]

Thanks for the link, I've submitted this as a bug report through there

[Stephen Sifers]

Hello @James Bylett 

Thanks for coming to our Community and reporting the unfortunate conflict with Microsoft Defender. Our bug reporting process is documented within Troubleshoot problems with Rovo Dev CLI.

While I don't believe this to be a bug, it is more of a false positive with Microsoft Defender. If you've submitted a bug through the above documentation, our teams will be able to coordinate a resolution.

-Stephen Sifers

[James Bylett]

Thanks for the response, I did assume it to be a false positive, but nonetheless it is not a trivial matter for us to ignore such a report, and I doubt we are the only ones who will experience the same issue given how commonly used Microsoft Defender is. It would be helpful to understand why the executable is triggering this alert and preferable if something can be updated to prevent it triggering whatever it is that is causing Defender to report it as such

[Dr Valeri Colon _Connect Centric_]

@James Bylett This is a known false positive. Microsoft Defender occasionally flags the atlassian_cli_rovodev.exe binary because of the way it bundles its runtime, not because of actual malware. Atlassian has verified the file is safe. Updating Defender’s definitions or adding the binary to your allow-list resolves it. Atlassian is working with Microsoft to eliminate the false alert.