Trojan Detected | Real or False Positive?

[czaczaczar]

It's the first time I've seen this app as a trojan. Any thoughts? https://www.virustotal.com/gui/file/1c4e1847c722db18d58216c43aa40ad87c8a38aa6196e69d55c0687b8506bf94/details

[swaggerino]

same here. I'll hold off until the dev can confirm this is a false positive.

[ItsBluey]

https://github.com/valinet/ExplorerPatcher/issues/3228#issuecomment-2094065943

[hpchavaz]

Same.

So:

1. I read the Falsely detected as HackTool:Win64/ExplorerPatcher!MTB #3228issue that deals with the ExplorerPatcher!MTB alarm.
2. I set WD to ignore this alarm.
3. But WD throws alarm for Backdoor:Win32/Bladabindi!ml

[perdrix52]

Windows Defender also complains

[JossLadanyi]

Bitdefender also quarantines the update stating: 'The file C:\Users\xxxxxxx\AppData\Roaming\ExplorerPatcher\Update for ExplorerPatcher from https꞉∕∕github.com∕valinet∕ExplorerPatcher∕releases∕latest∕download∕ep_setup.exe has been detected as infected with Trojan.GenericKD.74037883 and Bitdefender could not clean this item. A device restart is required to finalize the cleaning process.'

[DUser6]

Seriously? We've been over this. https://github.com/valinet/ExplorerPatcher/issues/3228

[alex-zadara]

Same for me - Bitdefender

[fifowole]

Confirming issue with MS Defender

Detected: HackTool:Win32/Patcher!MTB Affected items: file: C:\Users\XXXX\AppData\Roaming\ExplorerPatcher\Update for ExplorerPatcher from https꞉∕∕github.com∕valinet∕ExplorerPatcher∕releases∕latest∕download∕ep_setup.exe

[DaveJ61]

Same here...

[goedzo]

Also not able to update. Windows defender blocks it as saying its a virus / hacktool.

[dlnilsson]

quote from the release page at https://github.com/valinet/ExplorerPatcher/releases/tag/22621.3880.66.5_5094108

> [!WARNING]  

You are downloading a file flagged as malware by Microsoft and very likely by other major antivirus vendors. We believe that this false flag indicates Microsoft's hatred against this software, not because this contains a virus or such.

Please include the following files and folders in your antivirus' exclusion list to prevent issues due to antivirus detections:

`C:\Program Files\ExplorerPatcher`
`%APPDATA%\ExplorerPatcher`
`C:\Windows\dxgi.dll`
`C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy`
`C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy`
For Defender, you can run the following script in PowerShell as an administrator:

```ps
Add-MpPreference -ExclusionPath "C:\Program Files\ExplorerPatcher"
Add-MpPreference -ExclusionPath "$env:APPDATA\ExplorerPatcher"
Add-MpPreference -ExclusionPath "C:\Windows\dxgi.dll"
Add-MpPreference -ExclusionPath "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy"
Add-MpPreference -ExclusionPath "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy"

If you are downloading from this page, please temporarily disable real-time protection or save to a folder excluded from antivirus scans.

Issues related to antivirus detections will be closed immediately. Discuss about this in #3228.

[Menno5]

https://github.com/valinet/ExplorerPatcher/discussions/3122#discussioncomment-10612497

[perdrix52]

This is new - previous updates worked fine

[Menno5]

This is new - previous updates worked fine

It is indeed new. MS has deemed EP dangerous and conveyed it as such to the AV world. Hence all the sudden commotion.

[Amrsatrio]

[!WARNING] You are downloading a file flagged as malware by Microsoft and very likely by other major antivirus vendors. We believe that this false flag indicates Microsoft's hatred against this software, not because this contains a virus or such.

Please include the following files and folders in your antivirus' exclusion list to prevent issues due to antivirus detections:

• C:\Program Files\ExplorerPatcher
• %APPDATA%\ExplorerPatcher
• C:\Windows\dxgi.dll
• C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
• C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy

For Defender, you can run the following script in PowerShell as an administrator:

Add-MpPreference -ExclusionPath "C:\Program Files\ExplorerPatcher"
Add-MpPreference -ExclusionPath "$env:APPDATA\ExplorerPatcher"
Add-MpPreference -ExclusionPath "C:\Windows\dxgi.dll"
Add-MpPreference -ExclusionPath "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy"
Add-MpPreference -ExclusionPath "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy"

If you are downloading from this page, please temporarily disable real-time protection or save to a folder excluded from antivirus scans.

Issues related to antivirus detections will be closed immediately. Discuss about this in #3228.

Read, everyone. I do not want to say that this is not a virus other than the reason statement above. If you are scared then stay on 65.5 (last release without detections) and freeze your OS updates.

It is just the installer that is flagged -- the DLLs that carry the patches are fine.

[Amrsatrio]

@Menno5 So 65.5 just got flagged as dangerous today by Kaspersky?

[Menno5]

@Menno5 So 65.5 just got flagged as dangerous today by Kaspersky?

Sorry, I was confused here. Kaspersky started whining when trying to update within EP and also when downloading it manually. But that's of course for the 66.5 version. Just downloaded the 65.5 to check and when scanned, Kaspersky has no problems with it.

[Amrsatrio]

@hpchavaz Add the folders mentioned into exclusions. You will never have a luck with the "Allow on device" button.

[Amrsatrio]

I am making a new PowerShell-based online installer now so that what it does should be more transparent. And most importantly it shouldn't do various of stuff just by opening it which is what a malware usually does.

[DaveJ61]

I ran the above script in PowerShell as an administrator. All is working as expected. Thank you.

[alex-zadara]

I am getting this error when trying to run in power shell (as administrator):

[Amrsatrio]

@alex-zadara 0x800106ba means Defender is not active. You may have another antivirus program active.

[fifowole]

Adding "c:\Users\XXuserXX\AppData\Roaming\ExplorerPatcher" in antivirus exclusion solved the issue. Taskbar update and finally Win10 start menu is back again :)

[perdrix52]

You should report it to MS as a "FALSE POSITIVE" and ask them to justify their classification of it as malware. If you don't complain to them they will continue doing it - if you do there's a chance they will stop

[Amrsatrio]

@perdrix52 Tried, no luck. They did not give me a reason why but instead added it as malware into the "next definition update."

[goedzo]

@perdrix52 Tried, no luck. They did not give me a reason why but instead added it into the "next definition update."

Probably that means that it will be marked safe again when the next definition update is received.

Edit: So no, they just flagged it?

[Amrsatrio]

Edited my comment.

[perdrix52]

I got errors trying to run the script:

Add-MpPreference : Operation failed with the following error: 0x%1!x!
At line:1 char:1
+ Add-MpPreference -ExclusionPath "C:\Program Files\ExplorerPatcher"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference],
   CimException
    + FullyQualifiedErrorId : HRESULT 0xc0000142,Add-MpPreference

David

[Amrsatrio]

Did you run PowerShell as admin? Can you screenshot the console window fully with the title bar?

[perdrix52]

Running as Admin seemed to work - 66.5 now installed