search

valinet / ExplorerPatcher

This project aims to enhance the working environment on Windows
GNU General Public License v2.0
22k stars 968 forks source link

Falsely detected as HackTool:Win64/ExplorerPatcher!MTB #3228

Closed Comeonnoob closed 1 week ago

Comeonnoob commented 2 weeks ago

For some reason, latest release of EP keeps getting false flagged by Windows defender as HackTool:Win64/ExplorerPatcher!MTB. I have to exclude this app's folder from Program Files manually to uninstall it properly. What is going on?

изображение

Amrsatrio commented 2 weeks ago

Microsoft does not like EP anymore, seems like. It's understandable since they've been removing legacy stuff which EP resurrects. Adding to exclusions or compiling your own EP seems to be the only way now.

pyrates999 commented 2 weeks ago

You can also set windows defender to exclude C:\Program Files\ExplorerPatcher so future updates won't be blocked by windows defender. You can also set windows defender to exclude the directory that you manually download EP to so you can install it without windows defender blocking it.

Amrsatrio commented 2 weeks ago

Also %APPDATA%\ExplorerPatcher

Vlad55432 commented 1 week ago

microsoft is so mad ngl

Apis035 commented 1 week ago

Thats not a false detection. They literally named it as "HackTool:Win64/ExplorerPatcher!MTB" because they don't like EP.

kpietraszko commented 1 week ago

It would be nice if EP deleted ep_setup.exe as soon as possible after an update, that would probably decrease the detection rate.

pyrates999 commented 1 week ago

It's used for uninstalling. It can't be deleted before then.

Comeonnoob commented 1 week ago

You can also set windows defender to exclude C:\Program Files\ExplorerPatcher so future updates won't be blocked by windows defender. You can also set windows defender to exclude the directory that you manually download EP to so you can install it without windows defender blocking it.

Thank you, had to use this

Also it looks like Windows 11 24H2 update might be a disaster because Microsoft is actively blocking StartAllBack as well. Not good, Microsoft needs lawsuit from someone with a decent anmount of money.