Unable to download version 0.9.1 due to zip file being targeted as a Trojan

[shapman88]

Bug Description

After 0.9.1 was released, it was downloaded on a Windows 11 professional computer in both chrome and Firefox and was immediately targeted and removed as a Trojan unlike all previous versions.

Environment Information

• Operating System: Windows 11 professional
• Fansly Downloader Version: 0.9.1
• Fansly Downloader Type: Fansly_Downloader_NG-Windows-v0.9.1.zip
• Specific creators name: N/A

User Research

I have done the following:

• [X] Looked through old GitHub issues
• [X] Read the config.ini options
• [X] Searched the Web (like DuckDuckGo)

[prof79]

Do you have a specific security product installed? I didn't get this on Win11 using built-in defender just back-downloading for myself to deploy/test in my own downloads folder.

[shapman88]

No I don't. I'm just using the built-in Windows defender as well.

Windows 11 Chrome: It will download but not get past the download notifications. It gives a "failed-virus detected" notification, and the file is not located where it should be saved.

Windows 11 Firefox: It will download and show up in the location where it should be saved, but will disappear almost immediately after the download is complete.

Windows 10: I am able to download it from both chrome and Firefox, but it will trigger Windows defender to remove it as a severe threat. The only difference here is that I have the ability to select to allow the downloaded file to remain (which is not there currently on Windows 11).

[shapman88]

It looks like the only issue is with downloading it. Once it is downloaded and allowed, it works fine on Windows 10 and Windows 11 with no issue.

[prof79]

Funny. My default is Firefox 123.0.1 as of now.

Also looked here, looks nice except one outlier (who even knows that one) but major vendors are all fine.

https://www.virustotal.com/gui/file/7421106b567fe73d5ff7da2612f1b1f2787d06c381c8e681c9bfd4e517c8a218?nocache=1

[shapman88]

Weird. My Chrome version is 122.0.6261.129 and my Firefox version is 123.0.1 as well on all the machines I tested with. Windows is also fully up-to-date on each machine that I tested on.

[ImSoDan]

I'm having the same issue on Windows 11 with Chrome 122.0.6261.129 . It's windows defender that automatically triggers each time and deletes the file archive. For some reason clicking to 'allow on device' hasn't seemed to work.

[juntrone]

If you temporarily turn off "Real-time protection" in the Virus & threat protection settings in Windows Security it should let the download through

[bssoul]

Blocked me from downloading on windows 10 I'm using built in windows defender. I shut it down until I downloaded & installed then turn it back on. Go to windows security/virus & threat protection/scroll down to virus & threat protection again and click manage settings & turn it off until downloaded & installed then turn back on. Works fine👍

[shapman88]

It looks like the same thing is happening with 0.9.3. The same steps to circumvent still apply. Looks like this is just good to be the new normal for now.

Although I'm a little scared to use it now, I just want to say thank you @prof79 so much for being so responsive and helpful. Much appreciated.

[prof79]

Thanks @shapman88 I don't know if I can fix this somehow in the future because this is out of my control; maybe I should check various pyinstaller versions for better compatibility in regard to those scanners but I currently lack the time to do so. Packing up a whole Python runtime plus scripts in a self-extracting executable always has the potential for pattern recognizers/heuristics in anti-malware products to go haywire. Just don't know why almost the same software gives different results on different PCs.