In version 1.1.1, a Trojan horse is detected by Windows Defender.

[HIJIKIsw]

I believe it is a false positive. I would appreciate it if you could investigate the cause.

[fefo-dev]

1.1 https://www.virustotal.com/gui/file/e5da7e841e94587da24bfacd4d3b7ea0e177b12f91bc42dc9a24daa71d08ee09/detection 1.1.1 https://www.virustotal.com/gui/file/c34cc41f218bf35bae68b7762cd1069f7edcac9ee2c1aa11d25796c6b9c27f4e/detection

Might be related to the update fetcher, although 1.1 didn't trigger Defender.

Checking the highlighted CVEs it's likely due to lack of security.

[AltimorTASDK]

This might simply be due to the combination of connecting to the internet and injecting a DLL. I’m not sure what else it would be. It doesn’t drop any files, it only tells the user to get the update.

[YoJimbo0321]

I am also having issues with the latest release.

[AltimorTASDK]

I submitted the file to Microsoft and the issue should now be resolved.

We have removed the detection. Please follow the steps below to clear cached detection and obtain the latest malware definitions.

1. Open command prompt as administrator and change directory to c:\Program Files\Windows Defender
2. Run “MpCmdRun.exe -removedefinitions -dynamicsignatures”
3. Run "MpCmdRun.exe -SignatureUpdate"

Alternatively, the latest definition is available for download here: https://www.microsoft.com/en-us/wdsi/definitions

Thank you for contacting Microsoft.

Virustotal says the injector matches a malicious TLS client fingerprint, so it’s possible that cpp-httplib was used by some malware and its TLS behavior got flagged.

[YoJimbo0321]

Thanks for the update! In case anyone else is still having issues, I found that, in addition to following the above steps to update my malware definitions, I also had to clear my Windows Defender Protection History.

This can be verified by navigating to the Protection History dashboard (Windows Security > Virus & threat protection > Protection history). The .zip file was still marked as being blocked from downloading after previously having been mistaken for malware.

To clear the blocked file history, I had to delete the files in the folder located at:

...\ProgramData\Microsoft\Windows Defender\Scans\History\Service

After that, I was finally able to download strivehitboxes.zip without issue.

EDIT: After unzipping the file and attempting to run it, the file was once again quarantined by Windows Defender despite having updated my malware definitions. I had to choose to manually restore the file at the location in the attached screenshot, and it appears to finally work.

[AltimorTASDK]

Looks like it's showing up under a different detection name anyways. I'll replace cpp-httplib and see if it makes a difference.

[GGelatin]

I'm sure you're aware at this point but the latest version keeps flip-flopping between being trusted and being considered malware

Hope you're able to sort it out!

[YoJimbo0321]

Yeah... Unfortunately striveinjector.exe started refusing to open, and new downloads no longer work for me again.

[Saishy]

I can't use it either, and defender doesn't let me exclude it cos it says it's a trojan :2