[Bug] All shims reported as malware

[joaoricarte]

trafficstars

Bug Report

Current Behavior

All shims created after 18/04/2024 are being reported as malware, specifically HEUR.AdvML.B by Symantec Endpoint Protection. It only affects the files in the shims folder: %USERPROFILE%\scoop\shims\

Expected Behavior

Shims not being identified as malware.

Additional context/output

Symantec Endpoint Protection Version 14.3 RU8 build 10148 (14.3.10148.8000) scoop version: 0.4.0

Possible Solution

System details

Windows version: 10 (22h2)

OS architecture: 64bit

PowerShell version: 7.4.2 Additional software: Symantec Endpoint Protection version: 14.3 RU8 build 10148 (14.3.10148.8000) scoop version: 0.4.0

Scoop Configuration

{
  "aria2-enabled": true,
  "last_update": "2024-04-19T10:26:29.6173068+01:00",
  "alias": {
    "wsa": "scoop-wsa",
    "updheld": "scoop-updheld"
  },
  "scoop_repo": "https://github.com/ScoopInstaller/Scoop",
  "scoop_branch": "master"
}

[chawyehsu]

I believe it relates to #5730, the patched shim was reported a false positive

[joaoricarte]

I believe it relates to #5730, the patched shim was reported a false positive

It seems related.

[goyalyashpal]

though this issue was filed earlier, but that one has more input over there. so, if these issues are duplicates, then i'd suggest closing this one in favour of that one.

• https://github.com/ScoopInstaller/Scoop/issues/5915