Trojan Detected | Real or False Positive?

[czaczaczar]

It's the first time I've seen this app as a trojan. Any thoughts?
https://www.virustotal.com/gui/file/1c4e1847c722db18d58216c43aa40ad87c8a38aa6196e69d55c0687b8506bf94/details

[swaggerino]

same here. I'll hold off until the dev can confirm this is a false positive.

[ItsBluey]

#3228 (comment)

[hpchavaz]

Same.

So:

1. I read the Falsely detected as HackTool:Win64/ExplorerPatcher!MTB Detected as HackTool:Win64/ExplorerPatcher!MTB #3228issue that deals with the ExplorerPatcher!MTB alarm.
2. I set WD to ignore this alarm.
3. But WD throws alarm for Backdoor:Win32/Bladabindi!ml

[perdrix52]

Windows Defender also complains

[JossLadanyi]

Bitdefender also quarantines the update stating:
'The file C:\Users\xxxxxxx\AppData\Roaming\ExplorerPatcher\Update for ExplorerPatcher from https꞉∕∕github.com∕valinet∕ExplorerPatcher∕releases∕latest∕download∕ep_setup.exe has been detected as infected with Trojan.GenericKD.74037883 and Bitdefender could not clean this item. A device restart is required to finalize the cleaning process.'

[DUser6]

Seriously? We've been over this.
#3228

[alex-zadara]

Same for me - Bitdefender

[fifowole]

Confirming issue with MS Defender

Detected: HackTool:Win32/Patcher!MTB
Affected items: file: C:\Users\XXXX\AppData\Roaming\ExplorerPatcher\Update for ExplorerPatcher from https꞉∕∕github.com∕valinet∕ExplorerPatcher∕releases∕latest∕download∕ep_setup.exe

[DaveJ61]

Same here...

[goedzo]

Also not able to update. Windows defender blocks it as saying its a virus / hacktool.

[dlnilsson]

quote from the release page at https://github.com/valinet/ExplorerPatcher/releases/tag/22621.3880.66.5_5094108

> [!WARNING]  

You are downloading a file flagged as malware by Microsoft and very likely by other major antivirus vendors. We believe that this false flag indicates Microsoft's hatred against this software, not because this contains a virus or such.

Please include the following files and folders in your antivirus' exclusion list to prevent issues due to antivirus detections:

`C:\Program Files\ExplorerPatcher`
`%APPDATA%\ExplorerPatcher`
`C:\Windows\dxgi.dll`
`C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy`
`C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy`
For Defender, you can run the following script in PowerShell as an administrator:

```ps
Add-MpPreference -ExclusionPath "C:\Program Files\ExplorerPatcher"
Add-MpPreference -ExclusionPath "$env:APPDATA\ExplorerPatcher"
Add-MpPreference -ExclusionPath "C:\Windows\dxgi.dll"
Add-MpPreference -ExclusionPath "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy"
Add-MpPreference -ExclusionPath "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy"

If you are downloading from this page, please temporarily disable real-time protection or save to a folder excluded from antivirus scans.

Issues related to antivirus detections will be closed immediately. Discuss about this in #3228.

[Menno5]

#3122 (comment)

[perdrix52]

This is new - previous updates worked fine

[Menno5]

This is new - previous updates worked fine

It is indeed new. MS has deemed EP dangerous and conveyed it as such to the AV world. Hence all the sudden commotion.

[Amrsatrio]

Warning

You are downloading a file flagged as malware by Microsoft and very likely by other major antivirus vendors. We believe that this false flag indicates Microsoft's hatred against this software, not because this contains a virus or such.

Please include the following files and folders in your antivirus' exclusion list to prevent issues due to antivirus detections:

• C:\Program Files\ExplorerPatcher
• %APPDATA%\ExplorerPatcher
• C:\Windows\dxgi.dll
• C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
• C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy

For Defender, you can run the following script in PowerShell as an administrator:

Add-MpPreference -ExclusionPath "C:\Program Files\ExplorerPatcher"
Add-MpPreference -ExclusionPath "$env:APPDATA\ExplorerPatcher"
Add-MpPreference -ExclusionPath "C:\Windows\dxgi.dll"
Add-MpPreference -ExclusionPath "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy"
Add-MpPreference -ExclusionPath "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy"

If you are downloading from this page, please temporarily disable real-time protection or save to a folder excluded from antivirus scans.

Issues related to antivirus detections will be closed immediately. Discuss about this in #3228.

Read, everyone. I do not want to say that this is not a virus other than the reason statement above. If you are scared then stay on 65.5 (last release without detections) and freeze your OS updates.

It is just the installer that is flagged -- the DLLs that carry the patches are fine.

[Amrsatrio]

@Menno5 So 65.5 just got flagged as dangerous today by Kaspersky?

[Menno5]

@Menno5 So 65.5 just got flagged as dangerous today by Kaspersky?

Sorry, I was confused here. Kaspersky started whining when trying to update within EP and also when downloading it manually. But that's of course for the 66.5 version.
Just downloaded the 65.5 to check and when scanned, Kaspersky has no problems with it.

[Amrsatrio]

@hpchavaz Add the folders mentioned into exclusions. You will never have a luck with the "Allow on device" button.

[Amrsatrio]

I am making a new PowerShell-based online installer now so that what it does should be more transparent. And most importantly it shouldn't do various of stuff just by opening it which is what a malware usually does.

[DaveJ61]

I ran the above script in PowerShell as an administrator. All is working as expected. Thank you.

[alex-zadara]

I am getting this error when trying to run in power shell (as administrator):

[Amrsatrio]

@alex-zadara 0x800106ba means Defender is not active. You may have another antivirus program active.

[fifowole]

Adding "c:\Users\XXuserXX\AppData\Roaming\ExplorerPatcher" in antivirus exclusion solved the issue.
Taskbar update and finally Win10 start menu is back again :)

[perdrix52]

You should report it to MS as a "FALSE POSITIVE" and ask them to justify their classification of it as malware. If you don't complain to them they will continue doing it - if you do there's a chance they will stop

[Amrsatrio]

@perdrix52 Tried, no luck. They did not give me a reason why but instead added it as malware into the "next definition update."

[goedzo]

@perdrix52 Tried, no luck. They did not give me a reason why but instead added it into the "next definition update."

Probably that means that it will be marked safe again when the next definition update is received.

Edit: So no, they just flagged it?

[Amrsatrio]

Edited my comment.

[perdrix52]

I got errors trying to run the script:

Add-MpPreference : Operation failed with the following error: 0x%1!x!
At line:1 char:1
+ Add-MpPreference -ExclusionPath "C:\Program Files\ExplorerPatcher"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference],
   CimException
    + FullyQualifiedErrorId : HRESULT 0xc0000142,Add-MpPreference

David

[Amrsatrio]

Did you run PowerShell as admin? Can you screenshot the console window fully with the title bar?

[perdrix52]

Running as Admin seemed to work - 66.5 now installed

[perdrix52]

I also see one scenario happening with it being signed. MS will keep labeling it as a hack tool. And with it signed, they will then try to get the certificate it was signed with, to be rejected.

So I don't see anyway around this to stop AV from labeling it incorrectly.

No way is that likely

[SirWobbyTheFirst]

Rather than just try out signing the app and getting the satisfaction of an "I told you so" if it doesn't work out. Also it is not our job to fork the repo, vet the code and code sign it ourselves. I don't know C and C++ and I don't intend to subject myself to that, half the people here don't know it.

Either sign the project and find out if it works or not, or fold the repo and call it a day, either I'm unsubbing because the email notifications are doing my head in and I am not reading several novels that say the same thing "We just don't care."

Auf weidersen pet.

[JZersche]

For me personally, if NOD32 claims a file is safe, I generally trust it to be safe. It's not uncommon for other anti-virus software's to throw false-positives based on certain behaviors, but from my experience NOD32 gets things right, and NOD32 deems EP safe!

[JohnLBevan]

Also it is not our job to fork the repo

This is an open source project created by people giving up their free time... It's no ones job.

What value does your previous comment add to the discussion / how does it help the project and its community?

I upvoted an earlier comment you made as it was constructive; you'd named a concrete example of a project with a similar issue that had found a solution to their problem. However since then you've been increasingly rude to the project's maintainers, expecting them to be slaves to your ideas. Please take some time to think about the people involved and what they're getting out of this, and what affect your comments are contributing before posting again.

[valinet]

No way is that likely

Yeah, it’s very likely. What are you basing your statements on, besides gut feelings? We have given here arguments to support our skepticism:

• System Informer still is flagged by some AV vendors, as shown above by Amr.
• Microsoft’s Defender actually has intelligence to identify EP as EP. Then they label it as ‘bad’, without giving out any sensible reason as to why. It’s not a false positive, it’s deliberately done. That it is signed or not does not matter at this point. The signed status may just be a heuristic employed, but it is not the case here. The AV knows what it is dealing with and chooses to label it a certain way. No false positive, no need for a heuristic involving the signature of the app.

Auf weidersen pet.

Thanks for sparing us from bearing the uselessness of your replies, I would have helped you long ago with this, but, as mentioned, GitHub still lacks badly when it comes to effectively moderating here. Your view that we either sucomb to your non sense, either quit the project is idiotic to put it lightly. Your remark with ‘not being your job’, again, on the same line; it’s not my job either to do anything, but I guess that’s rather hard to realize when you’re just an entitled prick, you completely miss the point of what is discussed here and refuse to engage in a conversation with barbarism.

So long.

What value does your previous comment add to the discussion / how does it help the project and its community?

Exactly.

For me personally, if NOD32 claims a file is safe, I generally trust it to be safe. It's not uncommon for other anti-virus software's to throw false-positives based on certain behaviors, but from my experience NOD32 gets things right, and NOD32 deems EP safe!

Thanks for the feedback. Although, as I have explained above, in the case of Defender at least, we’re long past the suspicion of false positives. It’s a deliberate decision what they are doing and they haven’t been able to produce any meaningful facts or data to support their claims, they are just exploiting the position of trust and control they are into. And some feel the right thing to do is to side with the bully, even after the situation has been reasonably explained. To each their own then.

[goedzo]

What you described (and more) is already achieved by a way more robust infrastructure that we already have. Signing the distributed binary itself is useless to the whole process you described above. You can at this moment check the checksums of the unsigned files, it is the same thing, having them signed doesn’t add anything to it… We are losing focus, all the talk here is born out of and about some people’s unverified belief that signing will stop various AVs from politically targeting our releases. Which maybe, at least for a while.

I think you missed my point in my own simplified explanation of what I meant by my example. So sorry that you seems to be offended and even gave a thumbs down on the reaction. Let me retry it by what I mean to say with my example.

You explain perfectly right that you can use the checksums that are generated by the build-process of Github and then check that these numbers match the binary that come out of that build process and they ofcourse should match.

I explain that as an EXTRA step, a real human, that is identified as the OWNER of this project, also SIGNS of these binary with a verifiiable statment (signature) so that the whole world can verify that the version on Github, is actually the real version.

I hope this explains better what I meant and please don't take this example as the actual solution, as it is not. It is an oversimplification to explain the difference between machine/automatic signing versus human/verfified owenership.

I strongly believe having a mention in the README instead/in addition to the release page doesn’t make that much of a difference. I’d argue it’s even irrelevant.

Based on what you think it is not relevant? I always download most of my applications from github itself to get the latest version, spot fake website pretending to be the owner etc.

If I go to a website that says: Hey this version of the software will trigger your anti-virus, but no worries, it's safe just install it. Then I check the github and it says nothing about this at: For met that is a red flag that the website could even be a fake site trying to convince the user to install a fake version.

But hey, that is just me. Probably it is not relevant what I do to keep my computer somewhat safer......

Edit on the last comment: Yes the release page on Github is also a good place. I was referring on general / external website that is not hosted on Github. The reason I mentiod readme.md is because that is the first page you see, so it gets the most attention.

[goedzo]

Thanks for the feedback. Although, as I have explained above, in the case of Defender at least, we’re long past the suspicion of false positives. It’s a deliberate decision what they are doing and they haven’t been able to produce any meaningful facts or data to support their claims, they are just exploiting the position of trust and control they are into. And some feel the right thing to do is to side with the bully, even after the situation has been reasonably explained. To each their own then.

Exactly this. I think that Microsoft wants to kill the project and seeing how this discussion is going, they seem to be getting what they want. Would be very unfortunately if they succeed in this, so please be kind on the developers that created this great tool in their spare time to fix what Microsoft has caused in the first place.

[valinet]

Based on what you think it is not relevant?

Based on discussions like these still happening and exploding in such a way. But yeah, as with code signing, I am NOT fundamentally against, I just feel it’s not useful, but sure, I can add a mention to the README. As it is also in the releases page. The problem with the README is it is part of the git tree, so for every update I have to pollute the git history, while the releases page I can freely update at any point without any side effects. But yeah, it may be less front and center. Same as wiki. Tbh, expecting someone to shield people from anything is excessive imo… if some people miss the mention because it’s in the release page not in the README… yeah, they will get it eventually somehow. It could equally happen even if put into the README anyway - the kind that make the most toxic comments put here I can non-scientifically assure you that have probably not read even the README at all, so yeah…

Sorry, maybe I am a bit on the reluctant side, but I am too saddened by what I hear around here and regarding the current situation of people I profoundly respect for their work to be inclined to bother with these nuances at the moment.

edit: typo, forgot that capital NOT up there, sorry

[Menno5]

I've been using Kaspersky AV for many years now. And it too flagged EP as dangerous a week ago. But a few days later it was all okay again, they recognised it as being a false positive. Knowing Kaspersky, they would never do that if there would be any doubt about it. Also the rather fast drop in mentions over at VirusTotal shows this.

What amazes me, are the people here that have a kind of "outrage" about all this. They know that EP is altering Windows stuff, they know that EP does things to Windows that Microsoft did not intend for Windows 11. If security is such a hot thing for them, why use EP then in the first place? I just don't get that.

Personally, I will keep on using EP as long as possible. I'm using it without the exception rules and it all just works.
Of course I too understand the concern that people have. I too did raise an eyebrow when Kaspersky started screaming.
But reading here, other forums (incl the Microsoft ones) and learning that EP is not the only victim in all of this, I realised this was unusual but nothing more than that.

It all comes down to choice: if you don't trust it, uninstall EP and move on. If you are having doubts, keep an eye out for what's happening. Or , like me, realise this can always happen with these kind of programs. There are more than enough (freeware) programs that are deemed dangerous at first. Heck, I have 3D Fractal software that suddenly was a virus. But those were not actively prosecuted by Microsoft, so those were flagged as okay rather quickly.

@valinet
I admire your composure at this time. I doubt that I would have the patience for all of this. So, a huge thanks! :)

[perdrix52]

No way is that likely

Yeah, it’s very likely. What are you basing your statements on, besides gut feelings? We have given here arguments to support our skepticism:

I base that on experience of having worked for a number of security companies who issued certificates - none would revoke a certificate based on the say so of a third party without extensive investigation including contact with the certificate holder.

[valinet]

Yeah, I was replying to your "Not really likely" in regards to this:

I also see one scenario happening with it being signed. MS will keep labeling it as a hack tool. And with it signed, they will then try to get the certificate it was signed with, to be rejected.

That could definitely still happen and probably will.

I base that on experience of having worked for a number of security companies who issued certificates - none would revoke a certificate based on the say so of a third party without extensive investigation including contact with the certificate holder.

This I am not arguing against. Yeah, it may be and probably is so. But it is beyond the point. Again, we have seen signed software being flagged by AVs anyway, System Informer (or Process Hacker, its true name before a similar saga to what is going on here happened on their forums as well) being an example. That's what I am saying.

I base that on experience of having worked for a number of security companies who issued certificates

Anyway, considering this, how should I approach obtaining an EV certificate? Do you have any recommendation as to one that could actually help here (I heard some CAs are more preferred than others to tools like SmartScreen or Defender)? It would be used both for EP and for obtaining Microsoft signature on the drivers hosted in various other projects here (so that's why I think an EV cert is needed). Any pointers, or maybe more than that? Thanks.

[valinet]

Regarding SignPath, I am citing from their terms and conditions.

First of all, I think these general terms we have to look at:

Conditions for free OSS SignPath.io subscriptions

• No malware: The project must not contain malware or potentially unwanted programs. ✔(Even though some believe otherwise, for some reason)
• OSS License: The project must use an OSI-approved Open Source license without commercial dual-licensing for all components. ✔(GPLv2)
• No proprietary code: The project may not contain any proprietary, non open-source component (especially code published by a maintainer or an affiliated person/organization). However, you may include System Libraries in signed packages. For a useful definition of System Libraries, see section 1 of the GPL v3 license. ❌(Partially; whole EP is open source except the reimplemented taskbar which is binary only for now)
• Maintained: The project must be actively maintained. ✔
• Released: The project must already be released in the form that should be signed. ✔
• Documented: The project’s functionality must be described on its download page or in the app store entry of the respective platform. ✔(Reasonably so)

So, already an X. We move on:

Binary artifacts must be built from source code in a verifiable way. ✔(Hell yeah)
Every release needs manual approval for signing. ❌(I mean, what is the point of the automated build infra if I then manually go and touch the file - I either do not get its meaning, either the requirement here is rather moot imo)

Basically, there are A TON of conditions, I won't enumerate each and every one of them, needless to say, yeah, no go if you do not agree with them. But it is understandable, and still, at least they try to provide some solution, so I can only appreciate that.

The current CA regime does not recognize OSS projects, it is based on legal ownership and responsibility only.

This I agree the most. The CA regime is just a cash machine mostly: it is centered on revenue and creating a reunion of a few bodies which can discretionary tell everyone what is allowed and what not. Far from decentralized, far from inclusive to everyone, as shown. Far from mostly every noble principle in this world... Thank God for Let's Encrypt, at least.

So yeah, SignPath doesn't seem like an option to me. I'd still favor an EV certificate, due to its versatility at least. We have a legal entity here, that is not a problem, it has fiscal history of at least 5 years, it's active in the business, so yeah... how to go about that? Will also look into Azure Trusted Signing.

[valinet]

Looked a bit into Azure Trusted Signing:

Yeah, not a good start. Besides no straightforward tutorial on how to integrate with GitHub's CI (it's not as if GitHub was owned by Microsoft too), yeah, I get the feeling this is there so why say they have something, but it is so complicated to use that you might as well give up in the process. I mean, has Microsoft ever set up a web server. Have they seen how Let's Encrypt does it? They give the feeling they want to replicate that when it comes to software distribution on Windows, but besides that... it has nothing to do with the straightforwardness and simplicity of the former - typical Microsoft I guess. Plus, how lame it is to use some Microsoft tool just for the sole purpose of fighting yet another Microsoft tool - all while wasting your own time, because why not. We've all ready gone through fixing what they break with this project ironically, why do we need to endure even more from them this time???

Plus:

Does Trusted Signing issue EV certificates?
No, Trusted Signing doesn't issue Extended Validation (EV) certificates. We don't plan to issue EV certificates in the future.

Bummer, as expected though. I guess another testament to their commitment to openness, as they state: "Trusted Signing is part of the Microsoft commitment to an open, inclusive, and secure ecosystem." right on the front page. Big words that sound good, little actual actions in practice, the customary outcomes nowadays. Oh, well...

Also, $9.99 a month at least no matter you sign anything or not because... why not another subscription, right?

[perdrix52]

Recommendations for cert provider - sadly I'm a bit out of date here. I know that Certum (who was the last last free cert provider) has stopped doing free certificates. I'm pretty sure they now offer an open source signing cert of €69 (I don't think their cheaper options work for you). Take a look at https://shop.certum.eu/open-source-code-signing.html

[Bingies24]

To me ExplorerPatcher being specifically flagged by Microsoft is a badge of honor, they're trying to stop what fixes their half-functioning OS. I find it dumb that people are blindly trusting Microsoft instead of doing the research or building it themselves. Big thanks to everyone maintaining this project, sorry y'all had to deal with the drama.

[AlfonsoML]

I think that we all agree that the MS Defender is incorrectly flagging the latest versions as a virus. Wrapping it with a Cert won't change that, a Cert only can serve as a way to automatically verify that the file that we download to our computer hasn't been tampered with (instead of having to manually check hashes).
So what are the real options?

• Post in whatever news/media/social networks to make people aware of the situation so maybe MS can react and change their detection (as well as any other AV)
• Instead of telling people to disable their AV, tell them to download the code and compile it by themselves.
• other options?

I'm only begging to remove the current advice and NOT tell anyone to disable their antivirus.

[valinet]

I'm pretty sure they now offer an open source signing cert of €69 (I don't think their cheaper options work for you)

Interesting, although yeah, another condition from a cert provider is for them to provide some sort of cloud supported HSM. A USB key to be plugged into a PC doesn't really cut it. I mean, ideally, the CI/CD build recipe could be updated to connect to the cloud HSM and get the binary signed. That's the only realistic way I see it. I have looked at this in the past, believe me, it's more complicated than it needs to be, that's why I gave up, too much hassle and nothing really in return.

With a physical HSM, a so-so solution would be to host a signing server myself on some on-prem infrastructure where I plug the USB device into. But that opens a whole vector of vulnerabilities, since I have to take care to secure it and so on, when others specialized in this sort of stuff could do it (i.e. I do not want to take on my liability that I can easily avoid by not bothering). Plus, I am sure doing that scenario is kind of against their ToS. So all I am left is manually signing the releases, but to me, this defeats the whole promise and purpose of the automated CI/CD. Even if it weren't so, manually clicking a 'Sign' button on each release is an unnecesary process, and I do not know why most keep insisting with this sort of thing - I have set up the build script, yes, I am sure I want it to also sign the executables, I trust the dev env there, so why bother me on each and every time. Security via annoying users is not security, it's just an annoyance.

But maybe they support some form of cloud based HSM, I will look around their site.

a Cert only can serve as a way to automatically verify that the file that we download to our computer hasn't been tampered with (instead of having to manually check hashes).

No, again, it doesn't do that. I can still temper with the file and just sign it, I have explained this a million times. A cert does nothing in this scenario. It's just some believe it stops Defender or other products from flagging EP, that's all. I want to be clear about that. Let's stop spreading this misinformation. Digital signing here is useless from a trust point of view.

Digital signing only helps when you a resource is transferred over an unsecured channel. That's it. It helps the receiving party verify the transferred resource originates from the expected party, provided they share a common base knowledge (which in this case is the trusted root certification authority store in the OS). That's it, really. It doesn't tell you whether the resource is exactly what you expect, only that it is from who you expect. For the former, you still need to validate checksums, for example. And for the latter, a cert is not needed here, the goal is already met by the existing infrastructure, I explain again:

• GitHub CD/CI creates an artifacts archive. The ep_setup file is in there as well. The release page links to that artifacts file. You download that and check the ep_setup from in there against the ep_setup in the releases page. That's how you make sure that what you download is exactly what the CI/CD process generated. You do not need to have the binaries signed for this.
• The files are sent on your computer via HTTPs, which is itself encrypted. You already use certs for that, the communication is already authenticated and guaranteed not to be able to get tampered in flight. So there is no point in reencrypting/resigning the contents, you are guaranteed you receive whatever GitHub sents. It is just a matter of trusting GitHub.

So, when the file gets to your PC, provided you trust GitHub, and verify the release against the file in the artifacts, not only you are guaranteed the file is from us, ExplorerPatcher, which is what the cert does, but you are also guaranteed that the file is what you asked for, and not some modified file that we instead signed and uploaded in place of the original file. That's why I say, signing the executable is utterly redundant in this scenario.

Sure, if you then want to send the file to others in your local network over HTTP, let's say, then yeah, depending on your network config, the traffic might get tampered and the file changed. That's why you can send the checksum over. But that can be tampered too. And from there, you start developing a whole host of solution to address your problem. But it is your problem, what you do afterwards with the file is your choice and subsequent problem - I do not get why it has to be EP's problem. For what is worth, you or anyone want it signed, get yourself a cert (or issue yourself one, act as a CA on your managed PCs, whatever) and sign it and from there you benefit of the few benefits that come with signing for your own use case.

But tl;dr signing the app in this scenario brings no security benefits when it comes to the delivery of the executable from us (and not really us, GitHub's build infra, which we CANNOT touch) to you. None. It's just a supposed magic pill that some think will shut off Defender and its peers. If it weren't for that, no one really would have wanted that because... yeah, im the current context, it's useless.

Post in whatever news/media/social networks to make people aware of the situation so maybe MS can react and change their detection (as well as any other AV)

I have made submissions with the latest EP release here for the time being, despite some people's impression that we do not give a shit or are too obtuse or whatever non-sense I have had the pleasure to read in these threads throughout the years.

Instead of telling people to disable their AV, tell them to download the code and compile it by themselves.

Isn't that implicit? People need to be told that code in a git repo should be... compiled? Pardon me, but this is a developer's site first and foremost. And I never said not to do that. At every opportunity I encouraged people to do so. Not only that, I have made ep_make, an automation that sets a local temporary dev env that compiles the latest ExplorerPatcher from source on your PC, and intergates with the updater and so on. Still haven't done enough, eh? Like, c'mon... The advice about disabling AV or setting up exceptions are just another piece of advice, maybe some are interested in other points of view as well. From what is worth, I have heard that even locally compiled EP can nowadays trigger Defender sometimes, so yeah... why be against different solutions?

Why is "disable you AV" such a tabu, just because the higher powers deemed it 'bad'? I told you, I run without AV on all my PCs for years now, and all this has done is spare me from taking active part in these kinds of sagas, like here, and as reported elsewhere, like the laptop suddenly going to 100% CPU for no reason because Defender decided to do some non-sense or entered a loop it doesn't want to get out of and so on... Demand the freedom to make informed choices, then educate yourself and make informed choices. You know, AVs are hardly the only thing protecting the modern OS. If it were, we would be in deep shit today. Luckily, more robust mechanisms that make it redundant tbh, imo, are already in place. If you ask me, AV nowadays is just a relic, but yeah, nothing against whoever uses them, whatever works best for you, but do not complain to me when something from a 3rd party goes nuts and does not work as advertised... Complain to that 3rd party... It's strange to me why me, from the position of publishing the source code and ensuring I have an automated, untampered build env, it's me that I have to go though hoops to reason with some AV vendor that just comes, labels me 'bitch' and provides no actual proof for such statements. You know, in real life yo ucan get sued for this, it's called calumny.

I'm only begging to remove the current advice and NOT tell anyone to disable their antivirus.

Where am I telling people to do that? I think the release page makes mentions of how to add exceptions for paths where EP is located. What is bad in that? Please show me exactly what you want removed.

[perdrix52]

If you tamper your own stuff and sign it - that's not a valid test of digital signature - because YOU have the private key so you can sign anything - that's not the issue. The issue is the certification says a) that YOU signed it, and b) no-one else has tampered it.

[valinet]

If you tamper your own stuff and sign it - that's not a valid test of digital signature

We are not testing how digital signatures work here. I believe what needed to be said has been said, explained and outlined more than reasonably.

As stated, I will now shit off these forums for an indefinite period as a cooldown measure as we figure out the best course of action for the situation we are in. We will keep everyone updated here and via Discord about our decisions and updates.

Again, thanks again to everyone that contributed with constructive feedback and support.

[perdrix52]

Thats not what I meant - I meant that DS doesn't cover malware that is signed by the cert owner

[valinet]

Latest updates: Despite not really wanting myself to do so, as I do not see any value in doing it, I have submitted the latest ep_setup.exe to Microsoft for manual analysis and reverting their current classification

https://www.microsoft.com/en-us/wdsi/submission/5ced98e6-c350-4ee8-b9d0-45de5ad1df3c

My original description of the file provided via the submission form:

This file is an automated build of ExplorerPatcher, a Windows utility program whose source code is freely available on GitHub at https://github.com/valinet/ExplorerPatcher

The file is correctly identified as "ExplorerPatcher", which indeed is, it being the setup file, so we're not talking about a false positive, yet it is labeled as "malicious" by your product. On the advisory page (https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=HackTool:Win64/ExplorerPatcher!MTB&threatId=-2147057753), no supporting data for the claim is brought forward. My request is to retract this allegation, or otherwise provide proof. Please analyze the public source code and draw conclusions on that, and in general, refrain from making allegations without data to back them off, it is damaging to both our reputations, but especially yours, seeing how people can interpret your allegations as political decisions rather than security-driven ones, which certainly is damaging to the trust people put into your product.

I personally state that there is nothing malicious in the program, and that all the program does is behave as its user wants it to. I have taken measures to ensure that binary builds of the public source code are automated and untouched by human hands. In this regard, releases are compiled automatically on your GitHub infrastructure using CI/CD. Besides your dev env/toolchain injecting malware into the binaries, which I strongly believe is not the case, the executables are the direct result of automated compilation of public source code; thus, any complaint regarding the security should be based off something spotted in the source code. Please, let's engage in a conversation over that, if the case. Otherwise, please cease labeling the software as 'malware' at your earliest convenience.

Yours respectfully,
Valentin Radu
ExplorerPatcher developer

Here's the reply they gave via the portal:

ep_setup.exe
Submission ID: 5ced98e6-c350-4ee8-b9d0-45de5ad1df3c
Status: In progress
Submitted: Sep 17, 2024 4:34:35 PM
User Opinion: Incorrect detection
Analyst comments:

We have determined that the files meet our criteria for malware. At this time the detection will remain in place.

More detailed information about the approach and criteria categories currently used by the Microsoft researchers are available here:
https://docs.microsoft.com/windows/security/threat-protection/intelligence/criteria

Thank you for contacting Microsoft.

Tbh, as I expected: a bot-like reply, no actual useful info or way forward. Unregulated corporations at their finest. I maintain my opinion as to them using the AV as a political instrument, I have yet another argument for this at the moment.

PS: We have retracted on the previous decision and will keep the forums here open. Sorry for the mishap.

[aracg]

Thanks for re-enabling the comments (and for a fantastic piece of software of course!)

I think the MS flagging EP, while deliberate, might not be motivated personally or 'politically', but rather by simply wanting to play it on the safer side.

Considering EP users know that:

1. it is frequently falsely detected as suspicious due to its very nature
2. obviously requires elevated permissions
3. and that most users lack the expertise to verify that a given release is safe
   They are more likely to just install it, elevating permissions, ignoring alarms or configuring anti-malware programs to ignore it. In case something malicious does slip in somehow in the code, the impact might be much more serious, hence, the MS decision.

Please consider the scenario by which the backdoor was slipped into linux xz/liblzma library.
https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-backdoor
(short version: a new contributor / maintainer appeared, that after some time introduced a very sophisticated backdoor in the library, which went unnoticed for a long time)

Now, having this in mind... I noticed a new contributor to the EP. I also noticed that ep_setup.exe increased in size from 1.25 MB to 10.1 MB recently. I'm not saying there's anything wrong with it. I'm saying that since I don't have the expertise/resources to verify that, and seeing some warning flags, I get more reluctant to install it (or exclude it from my AV). I think the same thinking might have urged Microsoft to flag it as 'bad' to err on the side of safety.

Just wanted to share my perspective.

[valinet]

Please consider the scenario by which the backdoor was slipped into linux xz/liblzma library.

I am familiar with the xz backdoor. I have read your referenced article, and the references there. The topic is indeed very interesting, with a ton of opinions, some genuine and some interest driven imo.

I also appreciate and understand your point of view. But it is just that up to now, your point of view. My problem is with the lack of communication with Microsoft, despite our efforts to facilitate a dialogue here. I understand, you say that maybe Defender blocks ExplorerPatcher just because if we were to somehow fuck something up, intentionally or unintentionally, when pushed out the update will fuck a bunch of people. But that could happen with any other product out there, used on a daily basis, by far more people than EP. Take Chrome for example, there are thousands of contributions to Chromium. Is that soon to follow? Probably not.

That's why I feel it's just bullying the little guys that somehow disturb their business interest; they didn't seem to have a problem signing a driver which 100% of the time immediately crashed every piece of computer it was installed onto. Again, questions no one asks, because few actually understand what goes into that. All of us are forced to go though this non-sense of having drivers signed by Microsoft if we want to give them to others, yet, not even for the "big dogs" at least, they didn't seem to care doing a manual, superficial, review where they actually deploy the piece of code before signing it, and see how it badly misbehaves. If they are not doing even that, why say it is from a security perspective, when it looks like it is not...? To think about how CrowdStrike also missed the mark and couldn't stop the deployment up after seeing it crashes every computer, to me it looked like no one bothered to do any testing.

Idk, I don't think most people expect that Defender makes its decisions after some actual evidence, not on the logic that "better block this because if it were to be bad, it would cause a lot of havoc". Especially since this OS component cannot be, officially at least, disabled on most Windows installs - so maybe people expect it to take decisions on actual evidence, or reasonable heuristics? Or at the very minimum, explain a measure it takes. I haven't seen that. Okay, they say EP is malicious, but never have I or anyone else been given an official explanation, in non-bot language, from Microsoft, as to why is that. Latest case in point today, above. That's my problem. At least what they expect from us to mitigate. That we will do or are actually able to, that remains to be seen (for example, I cannot summon 20 vetted maintainers out of the blue just now).

I strongly believe in each and everyone's right to run whatever software they want on the CPUs they use (so PCs, phones and so on). With this, obviously comes the responsibility of deciding for yourself whether to run something or not.

I also noticed that ep_setup.exe increased in size from 1.25 MB to 10.1 MB recently.

About the increase in the installer size, it's simple, if you check the commit history: because Microsoft keeps removing system files from the OS which are needed for various features (for example, pnidui.dll which hosts the legacy WiFi flyout, for example), they are now shipped with the installer, hence the increase in size. You may not have the expertise, I understand that, but you have the resources to figure it out. There is a difference.

[Ruskie-it]

I am making a new PowerShell-based online installer now so that what it does should be more transparent. And most importantly it shouldn't do various of stuff just by opening it which is what a malware usually does.

How do I find that script? Is it also good to uninstall the existing installation of EP?

[pyrates999]

It hasn't been released yet.

[Ruskie-it]

It hasn't been released yet.

Sorry, I thought it was, since Dave in the subsequent comment said he ran that script (and had some issues). Thanks

[valinet]

And most importantly it shouldn't do various of stuff just by opening it which is what a malware usually does.

The idea here was that it made it easier for users to get going. You can't do much either, or at least couldn't back when the idea with the original installer came. Many programs just install, without asking anything after executing its installer, Chrome for example.

[Shana-V]

Latest version of Microsoft Defender no longer considers ep_setup.exe as a virus, ep_weather_host_stub.dll is still reported as a virus

[CinnamorollDing]

same here, Win11 McAfee trashed it away :(

[pyrates999]

Then you need to exclude the same directories and files in McAfee that you would in the powershell script for windows defender.