HookshotBuilder.exe from the new-builder release flagged and quarantined by Win11 Microsoft Defender #525
Labels
No labels
accessibility
autorelease: pending
autorelease: tagged
bug
dependencies
documentation
duplicate
enhancement
github_actions
good first issue
help wanted
invalid
question
testing wanted
wontfix
No milestone
No assignees
2 participants
No due date set.
Dependencies
No dependencies set
Reference
MagicBeanDev/Hookshot#525
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Builder version
new-builder
How you built
Hookshot Builder app (Windows)
Game files given to it
A .nup
The error
Visual Studio or Build Tools version, and Windows SDK version
No response
Operating system and free space on the output drive
Windows 11 26H2
Before you send it
I can agree, also happened to me
same issue here but directly after downloading the lastest .exe
Whats the reason for this ? ik sometimes stuff can show false positive but why this time
Not malware: an unsigned new exe gets flagged by Defender's machine-learning check. We are applying for free open-source code signing (SignPath Foundation) and submitting each build to Microsoft as a false positive meanwhile.
any fix yet?
Deactivate WD, or create a rule, or directory exclusion.
Tracked in #1003, follow there. That issue collects every report of antivirus false positives on the builder, and this one is linked from it with its GPU, version and log details. It is a false positive; the tracker says what you can do until the builder is signed. If it still happens on v2.0.6 (https://github.com/NotRexed/Hookshot/releases/tag/v2.0.6; Update next to Play in the launcher), please add a comment there with your
hookshot_log.txt.Can confirm it instantly gets flagged and quarantined.
I wanted to share my findings regarding Windows 11 Smart App Control blocking newer versions of HookshotBuilder.exe.
@shayderrr @notrexed
System specifications:
Version testing:
I checked the reported virus detections through VirusTotal and also scanned with Microsoft Defender and Malwarebytes. No infections were identified by my local scans.
Windows Event Viewer confirms that Smart App Control is blocking the executable.
Event details:
SHA-256 (V2.1.0):
8958DA7C6AAD2E386E5FAE1E7191798C6E1A5942A60048383B6CE0B869B68200
Workaround:
If the latest HookshotBuilder.exe is blocked by Smart App Control, try testing earlier releases individually until you find one that works on your system.
Once you find a working version, rename the builder executable to include its version number so you can easily identify it later.
Run that working builder and allow it to automatically download and update the latest Hookshot files. Continue using the working builder rather than switching to a newer executable that Smart App Control blocks.
In my case, HookshotBuilder.exe V2.0.12 works with Smart App Control enabled and successfully updates the latest files. I can continue using the V2.0.12 builder with the latest V2.1.0 files without disabling Smart App Control or other Windows security protections.
I also recently installed the latest Windows security update and ran DISM /online /Cleanup-Image /RestoreHealth followed by SFC /scannow through Windows Terminal (Admin.) Following these changes, I discovered that the generated hookshot.exe now launches successfully without being blocked by Smart App Control, which was not the case during my earlier testing.
I'm unable to determine whether this change resulted from the Windows security update, the DISM/SFC repairs, or an updated security reputation assessment. However, the generated executable is now functioning with Smart App Control still enabled.
These findings and workarounds may help others experiencing similar issues, although results may vary depending on the Windows installation and executable version.