Defender detects the last two versions as virus

theofaron commented

2023-06-23 15:24:44 +00:00

(Migrated from codeberg.org)

Am I the only one who has this problem? The version 1.6.4.0 and 1.7.2.0 are detected as virus by Windows 10 Defender and blocked. Is this being worked on or does no one care?

Am I the only one who has this problem? The version `1.6.4.0` and `1.7.2.0` are detected as virus by Windows 10 Defender and blocked. Is this being worked on or does no one care?

ltguillaume commented

2023-06-23 15:49:08 +00:00

(Migrated from codeberg.org)

I'll have to look into sample submission to at least Defender to prevent these false positives.

You can find more info here: https://codeberg.org/ltguillaume/librewolf-portable/issues/8

I'll have to look into sample submission to at least Defender to prevent these false positives. You can find more info here: https://codeberg.org/ltguillaume/librewolf-portable/issues/8

theofaron commented

2023-06-23 16:02:27 +00:00

(Migrated from codeberg.org)

Thanks for the really quick reply! Defender seems to be sensitive to AHK now, sure to be an annoying task for you to prevent.

ltguillaume commented

2023-06-23 16:23:33 +00:00

(Migrated from codeberg.org)

I don't have a Microsoft account and I'm sooo not gonna give them my phone number. But, of course, the only way to submit files to them is by having a Microsoft account:

https://www.microsoft.com/en-us/wdsi/filesubmission

I don't have a Microsoft account and I'm sooo not gonna give them my phone number. But, of course, the only way to submit files to them is by having a Microsoft account: https://www.microsoft.com/en-us/wdsi/filesubmission

theofaron commented

2023-06-23 17:28:31 +00:00

(Migrated from codeberg.org)

I can understand you well. I don't have an account either, and I definitely don't want one. Another translation for "sure to be an annoying task for you" was "certainly be a pain in the ass for you". That might be better...

ltguillaume commented

2023-06-23 19:16:23 +00:00

(Migrated from codeberg.org)

What happens if you add an exception for LibreWolf-WinUpdater.exe, and WinUpdater then self-updates? I think Defender still won't annoy you nag about it, right?

That being said, adding the file to the exceptions is not a real solution, of course.

What happens if you add an exception for `LibreWolf-WinUpdater.exe`, and WinUpdater then self-updates? I think Defender still won't annoy you nag about it, right? That being said, adding the file to the exceptions is not a real solution, of course.

theofaron commented

2023-06-23 22:22:38 +00:00

(Migrated from codeberg.org)

Adding the corresponding LibreWolf-WinUpdater.exe as an exception is actually my current solution. However, this is a bit annoying. So I added version 1.6.4.0 as an exception, so far, so good. During the last update, this version downloaded the new version 1.7.2.0, which then downloaded the current files from Libtrewolf. This process was then interrupted by Defender, because version 1.7.2.0 was of course not yet marked as an exception, prevented overwriting both the Librewolf files and the LibreWolf-WinUpdater.exe. Therefore, there was then no LibreWolf-WinUpdater.exe (neither the old nor the new one) to add to the exceptions. Or I did not find the right way.

So I guess it gets very complicated. You would either have to ask Microsoft each time BEFORE an update not to see the exe as a virus, which would probably slow down the update process enormously. Or replace the AHK part. Whether that is possible and how much effort that is, I can not judge. In any case, as I said, not an easy task.

I think Microsoft (and also some other virus scanners) make it too easy for themselves to detect every file with AHK content as a virus. But as a mere mortal there is nothing you can do about it.

Adding the corresponding `LibreWolf-WinUpdater.exe` as an exception is actually my current solution. However, this is a bit annoying. So I added version `1.6.4.0` as an exception, so far, so good. During the last update, this version downloaded the new version `1.7.2.0`, which then downloaded the current files from Libtrewolf. This process was then interrupted by Defender, because version `1.7.2.0` was of course not yet marked as an exception, prevented overwriting both the Librewolf files and the LibreWolf-WinUpdater.exe. Therefore, there was then no LibreWolf-WinUpdater.exe (neither the old nor the new one) to add to the exceptions. Or I did not find the right way. So I guess it gets very complicated. You would either have to ask Microsoft each time **BEFORE** an update not to see the exe as a virus, which would probably slow down the update process enormously. Or replace the AHK part. Whether that is possible and how much effort that is, I can not judge. In any case, as I said, not an easy task. I think Microsoft (and also some other virus scanners) make it too easy for themselves to detect every file with AHK content as a virus. But as a mere mortal there is nothing you can do about it.

ltguillaume commented

2023-06-23 22:32:28 +00:00

(Migrated from codeberg.org)

What's the path you added to the exceptions?

If you're running an installed version of LibreWolf, then WinUpdater is run from your %AppData%\LibreWolf\WinUpdater folder.

There's a "nuclear option", which is to just bundle the default AutoHotkey executable with the script itself (if you rename autohotkeyu32.exe to LibreWolf-WinUpdater.exe, then it'll run the script LibreWolf-WinUpdater.ahk in the same folder automatically. Some minor changes would have to be made to the script.

Downside is that the used resources, like the icons, would have to be separate files and it wouldn't look great.

Rewriting to another language is a messy endeavor, because AutoHotkey is ideal for handling very high level of abstraction stuff and pretty deep Windows API stuff all at the same time.

What's the path you added to the exceptions? If you're running an installed version of LibreWolf, then WinUpdater is run from your `%AppData%\LibreWolf\WinUpdater` folder. There's a "nuclear option", which is to just bundle the default AutoHotkey executable with the script itself (if you rename `autohotkeyu32.exe` to `LibreWolf-WinUpdater.exe`, then it'll run the script `LibreWolf-WinUpdater.ahk` in the same folder automatically. Some minor changes would have to be made to the script. Downside is that the used resources, like the icons, would have to be separate files and it wouldn't look great. Rewriting to another language is a messy endeavor, because AutoHotkey is ideal for handling very high level of abstraction stuff _and_ pretty deep Windows API stuff all at the same time.

theofaron commented

2023-06-23 23:44:42 +00:00

(Migrated from codeberg.org)

I use portable versions of programs as much as possible, including Librewolf. Saves a lot of time when reinstalling a system.

I haven't really added an exception either. When you run LibreWolf-WinUpdater, it says "Threat blocked", which takes you to the protection history. There you then have 3 options: Quarantine, delete, allow. I then chose allow, which results in the file not being blocked in other paths either (I have 3 portable versions). However, the file does not show up in the exceptions. The paths were:

C:\Portable\librewolf\LibreWolf-WinUpdater.exe
C:\Users\ItIsMe\AppData\Local\Temp\LibreWolf-Extracted\librewolf-114.0.2-1\LibreWolf-WinUpdater.exe

Defender detects LibreWolf-WinUpdater.exe as 5-year-old virus Trojan:Win32/Sonbokli.A!cl. For whatever reason.

If you don't have a Windows system, I'm happy to test new versions to see if Defender complains about them. I think the combination of downloading files from the internet and thereby overwriting files leads to detection as a virus. It is questionable whether this would be different in another programming language.

I use portable versions of programs as much as possible, including Librewolf. Saves a lot of time when reinstalling a system. I haven't really added an exception either. When you run LibreWolf-WinUpdater, it says "Threat blocked", which takes you to the protection history. There you then have 3 options: Quarantine, delete, allow. I then chose allow, which results in the file not being blocked in other paths either (I have 3 portable versions). However, the file does not show up in the exceptions. The paths were: ``` C:\Portable\librewolf\LibreWolf-WinUpdater.exe C:\Users\ItIsMe\AppData\Local\Temp\LibreWolf-Extracted\librewolf-114.0.2-1\LibreWolf-WinUpdater.exe ``` Defender detects LibreWolf-WinUpdater.exe as 5-year-old virus [Trojan:Win32/Sonbokli.A!cl](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AWin32%2FSonbokli.A!cl&threatid=2147728983). For whatever reason. If you don't have a Windows system, I'm happy to test new versions to see if Defender complains about them. I think the combination of `downloading files from the internet` and `thereby overwriting files` leads to detection as a virus. It is questionable whether this would be different in another programming language.

ltguillaume commented

2023-06-23 23:55:38 +00:00

(Migrated from codeberg.org)

If you don't have a Windows system, I'm happy to test new versions to see if Defender complains about them. I think the combination of downloading files from the internet and thereby overwriting files leads to detection as a virus. It is questionable whether this would be different in another programming language.

Well I guess we can do a rudimentary test to see if it's the actual behavior of the script, or just the fact that it's an AutoHotkey script.

Below is a compiled version of simply the following:

MsgBox, 64, AutoHotkey Test, Hi theofaron!

I kept the filename and the metadata/icons from WinUpdater in tact. Let's see how Defender reacts!

> If you don't have a Windows system, I'm happy to test new versions to see if Defender complains about them. I think the combination of downloading files from the internet and thereby overwriting files leads to detection as a virus. It is questionable whether this would be different in another programming language. Well I guess we can do a rudimentary test to see if it's the actual behavior of the script, or just the fact that it's an AutoHotkey script. Below is a compiled version of simply the following: ``` MsgBox, 64, AutoHotkey Test, Hi theofaron! ``` I kept the filename and the metadata/icons from WinUpdater in tact. Let's see how Defender reacts!

theofaron commented

2023-06-24 00:00:32 +00:00

(Migrated from codeberg.org)

Runs fine, Defender doesn't respond.

ltguillaume commented

2023-06-24 00:16:29 +00:00

(Migrated from codeberg.org)

Ah that's interesting.

Ok, I've prepped a few compiled scripts that are just snippets from WinUpdater. Let's see if any of them cause trouble.

Ah that's interesting. Ok, I've prepped a few compiled scripts that are just snippets from WinUpdater. Let's see if any of them cause trouble.

theofaron commented

2023-06-24 00:33:17 +00:00

(Migrated from codeberg.org)

LibreWolf-WinUpdater-download.exe
Check with Defender: no message
Execute: program wants to go online, Defender wants to check file in the cloud, allowed, no message from Defender

LibreWolf-WinUpdater-getcurrentversion
Check with Defender: no message
Execute: no message from Defender

LibreWolf-WinUpdater-powershell.exe
Check with Defender: no message
Run: powershell opens, no message from Defender

LibreWolf-WinUpdater-regread.exe
Check with Defender: no message
Execute: no message from Defender

LibreWolf-WinUpdater-schtasks.exe
Check with Defender: no message
Execute: no message from Defender

LibreWolf-WinUpdater-wmi.exe
Check with Defender: no message
Run: notepad opens, no message from Defender

LibreWolf-WinUpdater-download.exe Check with Defender: no message Execute: program wants to go online, Defender wants to check file in the cloud, allowed, no message from Defender LibreWolf-WinUpdater-getcurrentversion Check with Defender: no message Execute: no message from Defender LibreWolf-WinUpdater-powershell.exe Check with Defender: no message Run: powershell opens, no message from Defender LibreWolf-WinUpdater-regread.exe Check with Defender: no message Execute: no message from Defender LibreWolf-WinUpdater-schtasks.exe Check with Defender: no message Execute: no message from Defender LibreWolf-WinUpdater-wmi.exe Check with Defender: no message Run: notepad opens, no message from Defender

ltguillaume commented

2023-06-24 01:02:29 +00:00

(Migrated from codeberg.org)

Thank you for testing all this, much appreciated! If you don't mind, I'll prepare another batch soon, perhaps we can actually tackle this.

theofaron commented

2023-06-24 01:06:26 +00:00

(Migrated from codeberg.org)

You're welcome. After a few hours of sleep, let's try it again.

ltguillaume commented

2023-06-25 15:00:07 +00:00

(Migrated from codeberg.org)

I'm 99% sure that these tests don't trigger Defender, but hey, it kept me busy 😛

theofaron commented

2023-06-25 16:29:03 +00:00

(Migrated from codeberg.org)

When checked with Defender, everything was ok.

After launching the following programs, Defender wanted to send them to the cloud for verification:

LibreWolf-WinUpdater-ExtractPortable.exe
LibreWolf-WinUpdater-Install.exe
LibreWolf-WinUpdater-Log.exe

There were no warnings even after sending.

The following error occurred with the LibreWolf-WinUpdater-ExtractPortable.exe, I don't think it has to do with Defender:

When checked with Defender, everything was ok. After launching the following programs, Defender wanted to send them to the cloud for verification: ``` LibreWolf-WinUpdater-ExtractPortable.exe LibreWolf-WinUpdater-Install.exe LibreWolf-WinUpdater-Log.exe ``` There were no warnings even after sending. The following error occurred with the `LibreWolf-WinUpdater-ExtractPortable.exe`, I don't think it has to do with Defender:

ltguillaume commented

2023-06-25 16:34:42 +00:00

(Migrated from codeberg.org)

Well, that makes sense I guess. I'll think about some other ways to test. Thanks again for helping me out!

theofaron commented

2023-07-09 23:52:36 +00:00

(Migrated from codeberg.org)

Today LibreWolf was updated from version 114.0.2-1 to version 115.0.1-1 by LibreWolf-WinUpdater.exe version 1.7.8.0. No objection from Defender.

Today LibreWolf was updated from version 114.0.2-1 to version 115.0.1-1 by `LibreWolf-WinUpdater.exe version 1.7.8.0`. No objection from Defender.

ltguillaume commented

2023-07-10 07:07:56 +00:00

(Migrated from codeberg.org)

Very cool! Thank you for reporting 😃

nurturix commented

2025-04-17 14:15:14 +00:00

(Migrated from codeberg.org)

Today Defender detected WinUpdater as a Trojan:

Trojan:Win32/Wacatac.B!ml

Affected items: file: C:\Users\User\AppData\Roaming\librewolf\WinUpdater\LibreWolf-WinUpdater.exe

Today Defender detected WinUpdater as a Trojan: Trojan:Win32/Wacatac.B!ml Affected items: file: C:\Users\User\AppData\Roaming\librewolf\WinUpdater\LibreWolf-WinUpdater.exe See also here for other reports: https://www.reddit.com/r/LibreWolf/comments/1k15thk/i_know_this_may_be_a_false_positive_but_why_am_i/

nurturix commented

2025-04-17 19:38:54 +00:00

(Migrated from codeberg.org)

I restored C:\Users\User\AppData\Roaming\librewolf\WinUpdater\LibreWolf-WinUpdater.exe and did a manual scan after performing a security intelligence update, and now Defender doesn't complain anymore. So it seems whatever was wrong with Defender got fixed with an update. :)

ltguillaume commented

2025-04-17 19:47:00 +00:00

(Migrated from codeberg.org)

Thanks for reporting. I'll add that information to https://old.reddit.com/r/LibreWolf/comments/1k15thk/i_know_this_may_be_a_false_positive_but_why_am_i/mnmvi02/

Please upvote that post if you can.

Thanks for reporting. I'll add that information to https://old.reddit.com/r/LibreWolf/comments/1k15thk/i_know_this_may_be_a_false_positive_but_why_am_i/mnmvi02/ Please upvote that post if you can.

nurturix commented

2025-04-18 08:03:07 +00:00

(Migrated from codeberg.org)

Unfortunately, I don't have a Reddit account. Instead, I submitted a false positive report to SecureAge. I hope that helps.

ltguillaume commented

2025-04-20 07:29:44 +00:00

(Migrated from codeberg.org)

For reference: https://old.reddit.com/r/LibreWolf/comments/1k3ey3a/recent_update_virus/

nurturix commented

2025-04-20 12:22:55 +00:00

(Migrated from codeberg.org)

SecureAge's reply to my report was:

Hello, Your submission (LibreWolf-WinUpdater.zip) has been processed. The following files were found to be suspicious*, and hence were not flagged as wrong detections: /samples/LibreWolf-WinUpdater.exe If you are certain that these files are indeed clean, and would like our review team to have a second look, please kindly provide the following information ...

I wrote them back and included the info (URL etc.) they requested. I'm not expecting much, but who knows?

SecureAge's reply to my report was: > Hello, Your submission (LibreWolf-WinUpdater.zip) has been processed. The following files were found to be suspicious*, and hence were not flagged as wrong detections: /samples/LibreWolf-WinUpdater.exe If you are certain that these files are indeed clean, and would like our review team to have a second look, please kindly provide the following information ... I wrote them back and included the info (URL etc.) they requested. I'm not expecting much, but who knows?

ltguillaume commented

2025-04-20 12:40:57 +00:00

(Migrated from codeberg.org)

SecureAge is notorious for calling literally anything malicious. I don't understand why Virus Total even uses such a low quality product in their offering.

While this is just one user's opinion (https://old.reddit.com/r/techsupport/comments/1g9a0i4/secureage_virus_or_false_positive/lt4ohoo/?context=3#lt4ohoo), from what I see online (there doesn't seem to be much about this vendor), together with the fact that Apex uses machine learning, it seems likely that false positives are around the corner constantly.

Thanks for reporting it and sending them the additional info!

>SecureAge is notorious for calling literally anything malicious. I don't understand why Virus Total even uses such a low quality product in their offering. While this is just one user's opinion (https://old.reddit.com/r/techsupport/comments/1g9a0i4/secureage_virus_or_false_positive/lt4ohoo/?context=3#lt4ohoo), from what I see online (there doesn't seem to be much about this vendor), together with the fact that Apex uses machine learning, it seems likely that false positives are around the corner constantly. Thanks for reporting it and sending them the additional info!

ltguillaume commented

2026-03-28 20:32:42 +00:00

(Migrated from codeberg.org)

The occurrence of false positives has been almost completely resolved now by signing the executables 🥳

Rows
Columns

Defender detects the last two versions as virus #23