ChrisTitusTech / winutil

Chris Titus Tech's Windows Utility - Install Programs, Tweaks, Fixes, and Updates
MIT License
24.7k stars 1.5k forks source link

BitDefender detected virus when applying WPFTweaksBlockAdobeNet #2907

Closed himadieievsv closed 2 weeks ago

himadieievsv commented 1 month ago

Describe the bug

BitDefender detected virus when applying WPFTweaksBlockAdobeNet. This is the time I'm using this software and not sure about severity of that.

Logs:

Running Script for WPFTweaksBlockAdobeNet
WARNING: A runtime exception occurred.
WARNING: At line:1 char:1
+
This script contains malicious content and has been blocked by your antivirus software.

BitDefender:

PowerShell tried to load a malicious resource detected as Heur.BZC.ZFV.Boxter.834.66DF46A0 and was blocked. Your device is safe.

Screenshot 2024-10-10 143357

To Reproduce

Steps to reproduce the behavior:

  1. Go to Tweak tab.
  2. In Advanced Tweaks select Adobe Network Block.
  3. Click Run Tweaks button.

Expected behavior

BitDefender is happy.

Screenshots

Additional context

Marterich commented 2 weeks ago

Hi, Bitdefender is notoriously bad at flagging winutil incorrectly as malware. Most likely this has to do with some part of the heuristics engine detecting "suspicious activity" like editing the C:/WIndows/System32/drivers/etc/hosts file (which can be used to pretty much overwrite where your computer goes when opening a specific DNS Name. This functionality is also used by malware but in the case of the Adobe tweak it's used to pretty much blackhole the Adobe queries. We really cannot do anything about this kind of detection. (Otherwise, we would have to start using the same AV/EDR evasion techniques as the bad guys)
The only option we have would be to remove the tweak altogether. (Which would be a shame for all the people where the AV doesn't flag it)

Hope this helps. I will /close this issue as there is nothing we can do right now