I Think Windows Defender Has Stopped Aggressively Blocking Explorer Patcher

[CasePeak]

Based on my recent testing, it seems that Windows Defender no longer aggressively blocks Explorer Patcher. Instead, it now provides the red screen option to "Run anyway."

Can anyone confirm if it happens to them too?

[pyrates999]

Please post windows version and build. You can find this by running winver. Please include if you are running x86-64 or Arm. And what language your windows is in.

Need to know if this has occurred in a release of windows or an insider build.

[CasePeak]

Windows 23H OS Build 22631.3880

[ganzziani]

I was able to update Explorer Patcher and things work again. Windows 23H2 OS Build 22631.4317.
Last month it was not working.

[pyrates999]

read the release notes here on what commands to run for windows defender to exclude the files and directories needed for EP to run: https://github.com/valinet/ExplorerPatcher/releases

[bamerjamer]

My Windows Defender just quarantined the new update. My Windows version is v23H2 (OS Build 22631.4169).

My start menu is at the left side of the screen, but the Start menu is the Win11 version, not the selected Win10 version.

Here's the quarantine info:

Detected: HackTool:Win64/ExplorerPatcher!MTB
Status: Quarantined

Date: 9/20/2024 10:22 AM
Details: This program has potentially unwanted behavior.

Affected items:
file: C:\Users****\AppData\Roaming\ExplorerPatcher\Update for ExplorerPatcher from https꞉∕∕github.com∕valinet∕ExplorerPatcher∕releases∕latest∕download∕ep_setup.exe

[pyrates999]

Duplicate of: #3228

Please close this.

MS just doesn't like EP and has added it to windows defender, even though it is not a virus and not a hack tool.

All builds of EP are done by github build servers against the source code in the repo. Only binary is the reimplemented windows 10 taskbar and windows 10 start menu files. There is no third party build servers.

This is a false positive.

See the release notes here for the powershell script you can run that excludes all the directories necessary in windows defender: https://github.com/valinet/ExplorerPatcher/releases

The powershell script you must run with elevated privileges.

Future updates to EP won't be flagged then.

You can also set windows defender to exclude the directory that you manually download EP to so you can install it without windows defender blocking it.

if you get the error: 0x800106ba, it means Windows Defender is not active. You may have another antivirus program active.

[Lemnola]

The AV at work flagged it as well and I had to justify.
Let's hope the next builds will manage to avoid that situation. Flagged file was "ep_setup.exe"

[pyrates999]

It won't because MS wants to show ads in windows 11 and the windows 10 taskbar and start menu doesn't show ads.

[beeltink]

There's some work that needs to be done on this product. I've just been sanctioned for installing this on my computer, as it is detected as a PUA.
Why do several anti-virus programs flag this as a PUA / hackware?

[pyrates999]

Please list the scheduled task that you believe EP creates.

And it's because the other AV's follow what windows defender detects it as.

[beeltink]

Let's say the IT department suspected that the scheduled task was coming from EP..
The task was actually a common MS task: "CreateExplorerShellUnelevatedTask"...
https://devblogs.microsoft.com/oldnewthing/20220524-00/?p=106682

[pyrates999]

Then the IT department didn't google what the task was for.

[Amrsatrio]

We can't do anything more, this is now out of our control, no one at MS cares to get in touch with us to get the flagging removed 🤷

[uvwild]

i am trying to download EP using firefox windows 11.
i believe windows defender deletes it after the download. i cant get the file this way. so annoying.

[uvwild]

i had to disable virus protection in the settings to download it

[pyrates999]

read the release notes here on what commands to run for windows defender to exclude the files and directories needed for EP to run: https://github.com/valinet/ExplorerPatcher/releases