Defender flags HookshotBuilder.zip (release foliage-linux-updater) as Trojan:Script/Sabsik.EN.A!ml #393

Closed

opened 2026-11-07 23:26:57 +00:00 by kzaint-cl · 3 comments

kzaint-cl commented

2026-11-07 23:26:57 +00:00

(Migrated from github.com)

Builder version

1.0.0

How you built

Hookshot Builder app (Windows)

Game files given to it

A .nup

The error

Windows 11 23H2, Microsoft Defender (default settings). Downloading
HookshotBuilder.zip from the official release asset (published 7 Nov) is blocked
and the file is removed: category "Trojan", threat name Trojan:Script/Sabsik.EN.A!ml.
The previous HookshotBuilder.zip did not trigger this. Could you check whether this
is a false positive (e.g. one of the bundled scripts) and submit it to Microsoft
if so? Happy to give more details.

Visual Studio or Build Tools version, and Windows SDK version

w11 23h2

Operating system and free space on the output drive

w11 23h2

Before you send it

I'm on the newest release, or it still fails on it.
I searched the open issues for this error.
I'm not attaching game files or anything built from them.

### Builder version 1.0.0 ### How you built Hookshot Builder app (Windows) ### Game files given to it A .nup ### The error ```text Windows 11 23H2, Microsoft Defender (default settings). Downloading HookshotBuilder.zip from the official release asset (published 7 Nov) is blocked and the file is removed: category "Trojan", threat name Trojan:Script/Sabsik.EN.A!ml. The previous HookshotBuilder.zip did not trigger this. Could you check whether this is a false positive (e.g. one of the bundled scripts) and submit it to Microsoft if so? Happy to give more details. ``` ### Visual Studio or Build Tools version, and Windows SDK version w11 23h2 ### Operating system and free space on the output drive w11 23h2 ### Before you send it - [x] I'm on the newest release, or it still fails on it. - [x] I searched the open issues for this error. - [x] I'm not attaching game files or anything built from them.

ThatOoTFan commented

2026-11-07 23:55:25 +00:00

(Migrated from github.com)

False positive just as most scripts that starts with !ml

NotRexed commented

2026-11-08 05:39:56 +00:00

(Migrated from github.com)

The new release (https://github.com/NotRexed/Hookshot/releases/tag/new-installer) is a single small HookshotBuilder.exe (170 KB, no scripts inside) that downloads the tools itself and checks each against its checksum; the compiler comes from llvm-mingw's own official release. Defender scans it clean here. If your antivirus still removes a tool, the builder now says so plainly and has a Repair button that downloads it again.

NotRexed commented

2026-11-08 09:56:35 +00:00

(Migrated from github.com)

The zip release is gone: releases ship HookshotBuilder.exe only now. Code signing is being worked on; until then Defender may still flag new builds (false positive). Tracked in #525.