Flagged by Windows Defender

[fefo-dev]

I successfully installed the mod yesterday but someone else reached me after many unsuccessful tries, and when I considered downloading and sending the file Defender instantly blocked it.

Pretty much a given considering how these patches work, but please try to reach Microsoft for verification and whitelisting.

https://imgur.com/a/k18w56z

Thanks a lot.

[fefo-dev]

Welp, seems to be a widespread issue with your mods:

https://imgur.com/kFJJNKi

Likely has to do with your injection methods, but I don't know better. Hope you can figure it out.

[kkots]

Hi. I stopped trying to circumvent antiviruses after I compiled a fresh new Hello World C++ project in Visual Studio and it got a virus warning from Google Chrome that didn't let it get downloaded because of it.
We tried adding a VERSIONINFO resource to the project but that did not achieve anything. We tried generating a self-signed certificate and digitally signing the executable - that didn't work either.

Things like "patcher" or "DLL injector" will always get flagged by antiviruses because those programs tamper with another executable on the computer, much like a real virus would. The antivirus in this case seems to not really care what the injected DLL actually does, as in our case it is completely harmless, so the antivirus is detecting the sole attempt of injecting a DLL.

This is great that these warnings pop up, because that means that Windows Defender is actually working as intended, and while it may not be too smart, it is still properly detecting tactics and approaches employed by real malware.

This can't be fixed, unless Xrd adds built-in mod support where we can just drop our DLLs in a folder somewhere and have them load happily and that just is not the case.

I will keep these issues open until someone bright comes up with something and manages to build a version of this mod that does not get flagged as malware or modifies the source code enough or comes up with an entirely different approach to inserting a DLL into Xrd that does not trigger any antivirus.

[kkots]

@fefo-dev Suddenly, I made an attempt to remedy this issue.
New versions have been released for GGXrdFasterLoadingTimes, ggxrd_hitbox_overlay and GGXrdDisplayPing, and in all of them I have signed the executables with a self-signed certificate.
Let me know if that works.

[kkots]

I take it all back. I just compiled

int main() {
  return 0;
}

from a new Visual Studio project, and Windows Defender detected Trojan:Win32/Wacatac.B!ml
Rust people also complain it detects their Rust Hello Worlds as this virus (rust-lang/rust#88297).
Someone asked a question on Microsoft websites regarding this, they said !ml at the end means "machine learning". They claim to use machine learning for virus detection, which means we not only cannot understand why it's detecting a virus, but I don't even understand how it is possible to use AI to detect malware.

So here we are. It will keep triggering, and I can't do anything at the moment.

[fefo-dev]

Welp, disappointing.

Had a friend test both this and hitbox viewer and he initially informed both worked, but later they were tagged as before. Right now I'm testing https://github.com/kkots/GGXrdDisplayPing and no flags (works perfectly btw) but who knows if it will last.

I remember a similar situation happening to Dolphin, a decade old software at least by that time. They were able to resolve it eventually so I hope you are either able too or Microsoft artificial stupidity fixes itself.

[kkots]

Alright I got a really bright idea. I gather a few more virus detections from people and everything that you guys sent me so far are 32-bit console apps. I think Visual Studio's boilerplate code for console apps is just triggering the malware detections, so now for all of my projects I'm going to transition from console based apps to desktop window based apps, leaving console as an option only for Linux versions of apps. Because the window apps, such as GGXrdMirrorColorSelect, never got reported by anyone. Once I do that I will post here and we'll see if that helps.

[kkots]

@fefo-dev I am proud to announce that all of the tools:

• Hitbox overlay
• freecam
• GGXrdFasterLoadingTimes
• GGXrdDisplayPing

have now been migrated from being console apps to being desktop window applications. There are no longer any console apps (except Linux versions of patchers) published in the released .zip folders. That should definitely solve the issue of Windows Defender detecting Trojan:Win32/Wacatac.B!ml or Trojan:Win32/Phonzy.B!ml. Please let me know if I turn out to be wrong and then we can close this issue.

[fefo-dev]

From my light testing all versions work fine. After all everything worked until it didn't, so I hope Microsoft doesn't randomly flag you again.

Great work on all tools as always.

[kkots]

I have received a report today that ggxrd_hitbox_overlay v6.16mk3 is being recognized as a virus (exact name of virus definition unspecified), while ggxrd_hitbox_overlay v6.16, which is only slightly different, is not.

And so this issue reopens as it is still not really solved and that bright idea of mine was not really very bright or something.

[kkots]

Update as of 21.10.2025. All our attempts to remedy the issue have utterly failed. Even after self-signing all the executables and adding VERSIONINFO, and making sure there are none console apps and only GUI apps, Windows Defender is still recognizing everything, the whole .zip file, as a trojan.