1.2.0 version detected as trojan

[akamienski]

Which wasn't the case for earlier versions:

[WildByDesign]

Thanks for the heads up.

Judging by the message, it seems like the engine binary is what is getting the false positive.

I will report this to MS today and hopefully they don’t take too long to remove the false positive.

[WildByDesign]

I submitted this false positive to Microsoft a few hours ago and it seems like they have already removed the detection.

Can you please try downloading the same zip archive again (https://github.com/WildByDesign/ImmersiveUX/releases/tag/1.2.0) just to confirm that the detection is gone?

Thank you

[akamienski]

@WildByDesign still the same error

[akamienski]

@WildByDesign 1.2.1 was not blocked

[Dhyfer1]

@WildByDesign I have the same problem as the OP with the latest version, 1.6.1

[WildByDesign]

Thanks for letting me know. Although unfortunately I don't think there is much that I can do. The false positives come and go, especially in the first day or two after release.

I've sent the binaries to MS 7 or 8 times now with previous false positives. Each time they responded to me by telling me that Defender is not detecting it and they show me their two engines show "no detection".

So it's always really strange.

For example, if I compile the executables and copy them on USB to another machine and scan them manually with Defender or run full scan (with up-to-date definitions), Defender never detects them.

Yet, if you download them from the Internet (at least with Edge), Edge will tag it will some reputation thing and Defender will then detect the zip archive.

I may test password protecting the zip archive but I'm not confident that it will work.

[Dhyfer1]

Yes, it is strange. I also have Defender updated to the latest version (with up-to-date definitions). I have downloaded the zip file again, and just after the download is finished, a Defender notification appears without giving me time to unzip the file.

No way. I guess I'll have to disable the antivirus, unzip the file and add it to Defender's exclusions list. 🙎

[WildByDesign]

I've seen a lot of situations where turning off the Cloud-delivered protection in Defender might be enough. That is the part where it sends any executables to their cloud scanning stuff and it goes through all of their machine learning detection which is the cause for a lot of false positives in general. I personally think that that option causes more harm than benefit.

You would likely have to try downloading the release archive again after changing the setting because the archive gets tagged and the previous detection may stick with it.

I will get another machine (or VM) running and do some testing with Defender to get a better idea of what works and what doesn't work to try my best to avoid these false positive detections. I'll let you know if I have any success with it.

It's possible that the Reputation-based protection settings (screenshot below) might be the trigger of what tags downloads in Edge initially which then Defender reads these tags and decides to send to cloud for the machine learning detections. But I'll have to do some more testing and see what I can do to avoid it.

[Dhyfer1]

Today, when I was on my PC, I checked for updates and an update for Defender appeared with version number 1.439.400.0 After installing, I downloaded immersiveUX again, but this time Defender didn't show any alerts.

To be more sure, I scanned both files (ImmersiveEngine.exe and ImmersiveUX.exe) in Defender. The result was: No current threats

So problem solved by an antivirus update 🤷

[WildByDesign]

I am happy to hear that. It seems like Defender likes to tag them in the first certain amount of days after a release. Then after a certain amount of days the false positive always seems to go away on it's own.

I would still like to find a better way to avoid that in the first place. So I'll look into some options soon hopefully.

[Dhyfer1]

The problem continues with the new version 1.7.1. Defender keeps flagging both executables as Trojans 😮‍💨

[WildByDesign]

I compiled a release that is identical to 1.7.1 but adds password to the archive to hopefully avoid false positives.

Link: https://github.com/WildByDesign/ImmersiveUX/releases/tag/1.7.1-p

In my limited testing, the downloaded archive itself did not trigger any false positives.

But I did not test extraction yet. It is possible that the Mark of the Web (MoTW) that gets added to the archive may pass on to the binaries once extracted and may potentially trigger false positives, but I'm not sure. Not all archive programs pass along the MoTW to extracted files. And I'm not even 100% sure if that is the trigger or not.

Please let me know how it goes.

[Dhyfer1]

I have downloaded the new version 1.7.1-p. It doesn't matter if the file has a password or not, after unzipping it, Defender still flags both executable files as Trojans. 😔

The only solution I can think of is the one I mentioned earlier: disable the antivirus, unzip the file, and add it to the list of exclusions.