Possible vulnerability -exploit issue - (Exploit.Win32.BypassUAC) about rawtherapee

[Lawrence37]

Thanks for the details. Closing this for now as there is no verifiable evidence that RawTherapee is a trojan.

[Lawrence37]

Kaspersky is claiming RawTherapee is malicious, specifically a trojan. Most likely it is a false positive. Is Kaspersky flagging the RawTherapee program, or the installer?

[emreYbs]

Thanks for the reply and the input @Lawrence37. I have been busy and couldn't test in detail but as far as I can see, it is a false positive.

Kaspersky or Virus Total still claims it is clean, the program or the installer is clean. Just on the next day, or after you restart, then this notification appears from Kaspersky. (Exploit.Win32.BypassUAC.hfdk)

Kaspersky, Bitdefender, ESET say it is clean when I check the downloaded software and doesn't complain either while using Raw Therapee, but when I re-start the PC next day, then it, Kaspersky, says the software is malicious (Exploit.Win32.BypassUAC.hfdk).

Wireshark or firewall seems just okay and didn't witness a serious issue. So I suppose it can be just a false positive or maybe it can be related to my Windows10 VM.

I also uploaded the official software to Kaspersky's online scan and it still says clean. Weirdly, again the next day, it claims it is a trojan, etc:). Personally, on a VM, I do think it is a false positive.

If I can be more sure, then I'll let you know what I may find. Thanks.