Incident Response

Windows Defender Detected Citrix Services as Malware

Windows Defender has caused problems for some Citrix customers after deleting two services incorrectly detected as malware.

Eduard Kovacs

August 14, 2020

Windows Defender has caused problems for some Citrix customers after deleting two services incorrectly detected as malware.

The problem appears to be caused by the KB2267602 update. Windows Defender users who installed the update may have had their Citrix Broker and HighAvailability services on Delivery Controllers and Cloud Connectors deleted after they were erroneously detected as a trojan.

Windows Defender detects Citrix components as malware - Photo credits @CemBALIK

According to Citrix, impacted users may notice that the Broker service is no longer available in the Services console, that the BrokerService.exe file is missing from the Program Files folder, and an error saying that the Broker service could not be contacted.

Microsoft has released antivirus definition update 1.321.1341.0 to address the problem and Citrix has provided instructions on how to remove the buggy update and install the new one.

Citrix has also shared workarounds that can be used to restore impacted files and prevent Windows Defender from detecting them as malware.

Citrix earlier this week urged customers of its Endpoint Management (CEM) product, which is also known as XenMobile, to immediately install patches for multiple serious vulnerabilities. The flaws can be used to gain administrative privileges to affected systems, and the vendor expects hackers to quickly start exploiting them.

Advertisement. Scroll to continue reading.

Written By Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Latest News

Click to comment

Virtual Event: Threat Detection and Incident Response Summit

Wednesday, May 24, 2023

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.

Virtual Event: CISO Forum Virtual Summit

June 13-14, 2023

Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.

Breaking Enterprise Silos and Improving Protection

When teams have a way to break down enterprise silos and see and understand what is happening, they can improve protection across their increasingly dispersed and diverse environment. (Matt Wilson)

Security Pros: Before You Do Anything, Understand Your Threat Landscape

Regardless of the use case your security organization is focused on, you’ll likely waste time and resources and make poor decisions if you don’t start with understanding your threat landscape. (Marc Solomon)

Today’s Cyber Defense Challenges: Complexity and a False Sense of Security

Industry standard frameworks and guidelines often lead organizations to believe that deploying more security solutions will result in greater protection against threats. (Torsten George)

Cutting Through the Noise: What is Zero Trust Security?

With proactive steps to move toward Zero Trust, technology leaders can leverage an old, yet new, idea that must become the security norm. (Marie Hattar)

Triple Threat: Insecure Economy, Cybercrime Recruitment and Insider Threats

A wave of layoffs, coupled with increased recruitment efforts by cybercriminals, could create the perfect conditions for insider threats to flourish (Derek Manky)

Application Security

Source Code Security Firm Cycode Launches With $4.6 Million in Funding

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Eduard KovacsSeptember 24, 2019

Cybercrime

Cyber Insights 2023 | Ransomware

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Kevin TownsendFebruary 2, 2023

Cybercrime

Comodo Forums Hacked via Recently Disclosed vBulletin Vulnerability

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Eduard KovacsOctober 1, 2019

Topics for 2023 Cybersecurity Insights Series

CISO Strategy

SecurityWeek Cyber Insights 2023 Series

SecurityWeek spoke with more than 300 cybersecurity experts to see what is bubbling beneath the surface, and examine how those evolving threats will present...

Kevin TownsendFebruary 13, 2023

Management & Strategy

The Effect of Cybersecurity Layoffs on Cybersecurity Recruitment

SecurityWeek examines how a layoff-induced influx of experienced professionals into the job seeker market is affecting or might affect, the skills gap and recruitment...

Kevin TownsendJanuary 30, 2023

Hackers Stole Encrypted Backups, MFA Settings from GoTo, LastPass

Data Breaches

LastPass Says DevOps Engineer Home Computer Hacked

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

Ryan NaraineFebruary 27, 2023

CISO Conversations

CISO Conversations: Code42, BreachQuest Leaders Discuss Combining CISO and CIO Roles

In this issue of CISO Conversations we talk to two CISOs about solving the CISO/CIO conflict by combining the roles under one person.

Kevin TownsendMarch 1, 2023

CISO Strategy

Burnout in Cybersecurity – Can It Be Prevented?

Security professionals understand the need for resilience in their company’s security posture, but often fail to build their own psychological resilience to stress.

Kevin TownsendMarch 22, 2023

SECURITYWEEK NETWORK:

ICS:

SecurityWeek