Issue/Introduction

After upgrading ZSphere to 5.1.0, a customer might create a new template as follows:

1. Create a virtual machine from an old template.
2. Upgrade VMTools in the virtual machine to 1.5.9.
3. Export the virtual machine as a template again.
4. Create a virtual machine from the new template.

The new virtual machine page shows VMTools 1.5.9 as the latest version, but also displays:

The current VMTools version is outdated. Some features might be unavailable. Upgrade VMTools to the latest version.

These displays come from different decision paths. The version field can come from the actual virtual machine information or a GuestTools version tag inherited from the template. The "outdated version" warning also appears whenever the platform status is qgaState=NotUpgraded. Therefore, a displayed version of 1.5.9 alone does not prove that all VMTools components work normally.

This article covers only the confirmed root cause where Microsoft Defender quarantines zs-tools.exe. For driver, service, version-file, or status-refresh issues, return to KB-100553 for further routing.

Symptoms

Page behavior

• The page shows that VMTools is installed and its version is 1.5.9 or the latest.
• The page simultaneously displays an "outdated VMTools version" warning.
• New virtual machines created from the same template might continue to show the warning.

Typical behavior in the guest

VERSION: 1.5.9
qemu-ga: Running
zs-tools.exe: absent
Defender: quarantine records 1116/1117 are present

Key file paths:

C:\Program Files\Common Files\GuestTools\VERSION
C:\Program Files\GuestTools\zs-tools\zs-tools.exe

Defender records usually include:

Threat: Trojan:Win64/GoShell.GZX!MTB
Path: C:\Program Files\GuestTools\zs-tools\zs-tools.exe
Event ID: 1116 / 1117
Action: Quarantine

Typical platform behavior

• version=1.5.9.
• qgaState=NotUpgraded or NotInstalled, instead of Running.
• The QGA channel might be normal, but the host cannot detect zs-tools.exe, equivalent to qga=true、tools=false.

Environment

• Product: ZSphere 5.1.0.
• Verified builds: 5.1.0.485 and 5.1.0.499.
• Guest: Verified on Windows Server 2019 and Windows Server 2022.
• VMTools version: 1.5.9.
• Installation can be direct or inherited by exporting a virtual machine after installation as a template.

Unverified builds and other Windows versions can use the troubleshooting method for reference, but must not be classified directly as the same product issue.

Possible causes

Build the evidence chain in this order:

Page version/warning
  -> Whether platform GuestToolsState is NotUpgraded
  -> Whether VERSION, QGA service, and zs-tools.exe are complete in the guest
  -> Whether Defender 1116/1117 explicitly identifies the file
  -> Whether the QGA channel works normally
  -> Whether the state changes to Running after approved file restoration

The first three layers of evidence can establish a strong match with ZSV-12861. Restoring a trusted file on a test clone and observing status recovery is the strongest causal verification. If no Defender event exists or the file is normal, do not use similar page wording alone to assign this root cause.

Issue classification

• Issue type: Product bug/security software detection compatibility issue.
• Known issue: Yes, ZSV-12861.
• Jira status: Open/P1 as of 2026-08-13, with no confirmed official fixed version recorded.
• Verified versions: ZSphere 5.1.0.485 and 5.1.0.499; VMTools 1.5.9.
• Root cause: Microsoft Defender identifies the official GuestTools core program zs-tools.exe as Trojan:Win64/GoShell.GZX!MTB and quarantines it. The version file remains at 1.5.9, but the host cannot detect zs-tools. The platform state therefore cannot enter Running, and the UI continues to display the outdated-version warning.
• Impact: Guest configuration capabilities that depend on zs-tools might be unavailable, such as some network configuration, hostname/DNS synchronization, and guest information retrieval. Verify the specific capability through its actual call.
• Conclusion confidence: High, provided that the evidence combination in Check 5 is satisfied.

Resolution

Check 1: Read the platform GuestTools status

• Purpose: Confirm whether qgaState=NotUpgraded triggers the warning and exclude a real version difference.
• Run these read-only queries on the management node:

  zstack-cli QueryGuestToolsState vmInstanceUuid=<VM_UUID>
  zstack-cli GetVmGuestToolsInfo uuid=<VM_UUID>
  zstack-cli GetLatestGuestToolsForVm uuid=<VM_UUID>

• Results and conclusions:

Check 2: Check Windows services, the version file, and the core program

• Purpose: Confirm the pattern where the version marker exists but the core program is absent.
• Run these read-only checks in an elevated PowerShell session:

  Get-Content 'C:\Program Files\Common Files\GuestTools\VERSION' -ErrorAction SilentlyContinue

  Get-Service -Name qemu-ga,zstack_zwatch_agent -ErrorAction SilentlyContinue |
    Format-Table Name,Status,StartType

  Test-Path 'C:\Program Files\GuestTools\zs-tools\zs-tools.exe'

  Get-ChildItem 'C:\Program Files\GuestTools\zs-tools' -Force -ErrorAction SilentlyContinue

• Results and conclusions:

Check 3: Check Microsoft Defender quarantine records

• Purpose: Confirm who removed zs-tools.exe, the threat name, timestamp, and disposition.
• Elevated PowerShell:

  Get-WinEvent -FilterHashtable @{
      LogName='Microsoft-Windows-Windows Defender/Operational'
      Id=1116,1117
  } -MaxEvents 200 |
  Where-Object {
      $_.Message -match 'zs-tools.exe|GoShell'
  } |
  Select-Object TimeCreated,Id,Message |
  Format-List

  Get-MpThreatDetection |
  Where-Object {
      $_.Resources -match 'zs-tools.exe|GuestTools'
  } |
  Format-List *

• Results and conclusions:

Check 4: Confirm the QGA channel

• Purpose: Distinguish an abnormal QGA channel from normal QGA with missing zs-tools.
• Run on the physical host of the virtual machine:

  virsh qemu-agent-command <VM_UUID> '{"execute":"guest-ping"}'

• If it returns {"return":{}}: The QGA channel works normally. Together with the missing file and Defender record, this focuses the root cause on quarantined zs-tools.exe.
• If the command times out or fails: A QGA/VirtIO Serial channel issue also exists. Do not attribute every status problem to Defender.

Check 5: Confirm whether ZSV-12861 applies

You can confirm the issue with high confidence when all of the following evidence is present:

1. The ZSphere version is in the verified 5.1.0 environment or uses the same component version.
2. VERSION=1.5.9.
3. The qemu-ga service and QGA channel work normally.
4. zs-tools.exe is absent or explicitly quarantined.
5. Defender 1116/1117 identifies Trojan:Win64/GoShell.GZX!MTB and the exact file path.
6. The platform state is NotUpgraded/NotInstalled, not Running.

The evidence is insufficient if only the page says that the version is outdated while also showing 1.5.9.

Recommended actions

Preparation

1. Create a snapshot of the affected virtual machine or complete a system backup.
2. Confirm that the VMTools installation media is an official trusted ISO provided by the current ZSphere 5.1.0 environment.
3. Record current Defender events, VMTools version, file state, and platform GuestToolsState for rollback and comparison.
4. In production, validate on a test clone of the affected VM first; do not test security exceptions directly on the service VM.

Restore an existing virtual machine

1. A Windows administrator opens:

   Windows Security
   -> Virus & threat protection
   -> Protection history
   -> Locate Trojan:Win64/GoShell.GZX!MTB
   -> Confirm that the affected path is GuestTools zs-tools.exe path

2. After confirming that the file comes from trusted official media, select only "allow on device/restore" for that object. If Defender immediately quarantines it again, an exact file exclusion can be added temporarily after security approval:

   Add-MpPreference -ExclusionPath 'C:\Program Files\GuestTools\zs-tools\zs-tools.exe'

Do not disable Defender real-time protection globally or exclude the entire C:\ drive.

3. Use the official VMTools ISO provided by the current ZSphere environment to run repair or installation again and restore the missing zs-tools.exe.

4. Verify in Windows:

   Test-Path 'C:\Program Files\GuestTools\zs-tools\zs-tools.exe'

   Get-Service -Name qemu-ga,zstack_zwatch_agent -ErrorAction SilentlyContinue |
     Format-Table Name,Status,StartType

   & 'C:\Program Files\GuestTools\zs-tools\zs-tools.exe' nic-info
   $LASTEXITCODE

Expected: the file exists, both services are Running, nic-info returns valid information, and the exit code is 0.

5. Manually refresh and verify platform status on the management node:

   zstack-cli UpdateGuestToolsState vmInstanceUuid=<VM_UUID>
   zstack-cli QueryGuestToolsState vmInstanceUuid=<VM_UUID>

After 30–60 seconds, expect:

   version=1.5.9
   qgaState=Running
   zwatchState=Running

6. Refresh the page, confirm that the outdated-version warning disappears, and verify the previously affected guest configuration functions.

Repair the template source

If the affected VM was created from a remade template, the current template probably contains an incomplete installation state: VERSION is 1.5.9, but zs-tools.exe was quarantined before export.

1. Perform the restoration steps above on the source VM used to create the template.
2. Restart the source VM and reconfirm that the file is not quarantined, services work, and platform status is Running.
3. Shut it down normally and export the template again.
4. Create a test VM from the new template and recheck Defender events, files, services, and platform status.
5. Use it for batch creation only after verification. Stop distributing the old template and retire it through the internal process.

Repairing only one existing VM while continuing to use the original template does not resolve future batch-creation failures.

Clean up exclusions and roll back

• After verification, try to remove the temporary exact exclusion with approval from the security owner:

  Remove-MpPreference -ExclusionPath 'C:\Program Files\GuestTools\zs-tools\zs-tools.exe'

• After removing it, continue monitoring Defender events and file state. If quarantine occurs again, the current package still cannot run without an exception under the current definitions. Stop treating this as a long-term fix; retain the smallest security-approved exception or wait for an official fixed package.
• If restoration/reinstallation causes an issue, remove the new exclusion and roll back with the snapshot or backup according to the change plan.

Long-term solution

1. Track the official fixed package and applicable versions in ZSV-12861. Do not claim a fix without confirmation in Jira/release notes.
2. GuestTools release process should confirm binary provenance and SHA256, improve code signing, and pursue a Microsoft false-positive submission.
3. Before completing, the installer should check that critical files such as zs-tools.exe exist and are executable. If a core file is absent, installation must fail clearly instead of leaving only a version number.
4. Add pre-delivery checks to template creation: Defender events, critical files, QGA/ZWatch services, platform status, and one actual guest configuration call.

Additional information

When to escalate

• The installation media source or file hash cannot be confirmed.
• The customer security policy does not allow file restoration or an exact exclusion.
• Defender has no matching evidence, but the file is still absent.
• The file still cannot run nic-info after restoration, or the QGA channel is abnormal.
• qgaState is still not Running after refresh.
• Defender quarantines the file again after the exclusion is removed, requiring the security team to evaluate a long-term exception.
• Confirmation of the official ZSV-12861 patch, fixed version, or batch remediation plan is required.

Information to collect

• Complete ZSphere version and build number.
• Windows version, patch level, and system architecture.
• VMTools version, installation time, installation method, and template creation process.
• Output of QueryGuestToolsState, GetVmGuestToolsInfo, and GetLatestGuestToolsForVm.
• VERSION, QGA/ZWatch service, and zs-tools.exe file-check results.
• Complete Defender 1116/1117 events, definition version, and detection time.
• QGA guest-ping result.
• Platform status, page screenshots, and function verification results before and after restoration.

Before submitting a ticket, redact VM UUIDs, IP addresses, customer names, and similar information. Do not collect passwords, tokens, or session information.

Related issues

• ZSV-12861: Microsoft Defender identifies and quarantines zs-tools.exe in the latest 5.1.0 release; Open/P1 as of 2026-08-13.
• KB-100553: Multi-root-cause routing for a Windows virtual machine where VMTools is installed but the platform shows it as not installed.
• KB-100554: Yellow warning icons on VirtIO Serial/Balloon drivers cause abnormal VMTools status.
• Last verified on 2026-08-13.