Windows Defender (and a few other heuristics) actually think we're a virus. about evlwatcher

[shimuldn]

Crap.
https://www.virustotal.com/gui/file/a1a660f69729e9fbb255979c88eea3556a3477fb25b192fac17e3caf58b1e203/detection
Oh boy! Need to fix.

Signin will be great but there is no free option available.
The minimum I can find €25.00 https://www.certum.eu/en/code-signing-certificates/

[devnulli]

yea, looks like we need to sign the release.
http://blog.nirsoft.net/2009/05/17/antivirus-companies-cause-a-big-headache-to-small-developers/

[devnulli]

ok, so while i absolutely understand the necessity to sign EvlWatcher 2.0, (being written in c# its easily changeable and could be used badly, especially because it runs as service) but it hurts. why? because

oh man.. so 💸 💸 there go the 12€ donation money i got so far for EvlWatcher, and i can finally pay for EvlWatcher to be downloadable. 😠 as far is i know an extended EV somewhere well over 200€/year ---

and to be honest, that makes it really hard for small beneficial services to be maintained.. its a big kick in the balls of open source. i'll think about that a week or so and come up with what i'll do (self sign/buy it/not fixing it and publishing checksum/...)

[devnulli]

While I'm waiting until EvlWatcher can afford a certificate, i suggest the following workaround

Its pretty sure not a virus, when you make sure of the following:

• only download it from here (github)

If you download it from somewhere else:

• check its MD5
  • for v2.0 the MD5 is d658718ea9cc794e704b02b7c252365e
  • to check an MD5 on windows, type CertUtil -hashfile "EvlWatcher-v2.0 setup.exe" MD5

EvlWatcher 2.0 is written in C# and therefore easily readable and changeable.
So is it a virus when you didnt make sure of the above steps? Possibly, yea. Probably not, but possibly.

[devnulli]

Hi,

the new release has been signed, and we did a submissal to Microsoft Smart Screen, to report the false positive.
It will take a time for the certificate to gain trust, so i will leave that open to check back in a while.

It looks much better now though, I am certain that we will stop being a "virus" in some days

[shimuldn]

Wow, hoping for stupid MS will fix soon.

[devnulli]

To be honest.. they aren't SO stupid. It's okay to block unsigned code 😄 . But I will start calling them stupid if they still think we're a virus in one or two weeks 😁

[devnulli]

i no longer get virus warnings, and would close this now.

@shimuldn , do you get any download warnings?

[shimuldn]

@devnulli
Nope! Not a virus anymore! And developer verified :) thanks to 6 donner.
Good job.