3 ms·

Re: Microsoft removing 3rd party software - A friend of mine runs a 3-person software company making desktop Windows software. Nothing terribly exciting, think

Re: Microsoft removing 3rd party software - A friend of mine runs a 3-person software company making desktop Windows software. Nothing terribly exciting, think - a ToDo list or similar. They put nothing in the kernel, stick to documented API, make no deep tie-ins into the system (e.g. Windows Explorer extensions). Just a perfectly simple standalone piece of software with minimal dependencies that can run even on XP. Not two months ago they started getting reports that the software was disappearing from users' machines. The Start menu icon was still there, as was the Uninstall entry, but the EXE was nowhere to be found. Naturally they thought of the antiviruses, but there was no pattern. Fast forward two weeks and the only commonality between all reports was a freshly installed Windows 10 update. The update silently wiped their software off. And to understand why that happened or to file a "false positive" report with Microsoft, the only option was to cough up few hundred dollars for opening a "priority support" ticket with them. Not everyone was affected, just a fraction of a percent. You could still reinstall the software and Windows won't make a peep or complain in any way. While it made very little sense, it still clearly showed that users were no longer in control of their machines. Moreover, Microsoft outright lied when they said "all your files and apps will remain where they are" while installing an update. So it's not just about loosing control over your own computer, but it's also about being treated like a sheep that Microsoft owes no explanations to and can do what the hell it wants. I sure hope Kaspersky Labs will have enough rage, funds and patience to drag Microsoft through courts and whip it back in place.

userbinator 10y ago
You can also find various stories of AVs detecting perfectly clean Hello World programs as "malicious". One example I remember particularly clearly was a beginner who had just downloaded GCC and was starting to learn C, and wondering why the executable kept disappearing. It was his AV. Ironically, the same code compiled with MSVC didn't get detected... The other category of software that frequently gets false positives are demoscene productions, which admittedly do push the boundaries and can involve things like custom packers and unorthodox API usage, but are certainly not malicious by any definition. Of course there's also the cracks/patchers/keygens, which are not malicious to the user but are often detected as such anyway.
- obsurveyor 10y ago
  Just got a complaint yesterday of anti-virus software quarantining a file out of a users's .git folder, breaking the repo completely until they restored it.
ntauthority 10y ago
There's a difference between antivirus-induced removal (such as this, where it does not affect all users, and could be caused by a leftover of third-party antivirus FWIW) and a proper blacklist entry in the migration system Windows uses. The latter leaves no traces such as shortcuts/uninstall entries and actually shows a notification to the user; the former is as 'rough' as just removing the executable.
overgryphon 10y ago
Sounds like your friend ran into a bug. I don't see a reason to assume malicious intent unless Microsoft refuses to fix this issue.
TimJYoung 10y ago
I'm wondering if the issue is that the .exe isn't signed. Windows is getting a lot pickier about .exes and .dlls being signed with a cert, including wanting them to be signed with a SHA-256 cert in addition to the SHA-1 cert (which you'll want, for backward-compatibility with older versions of Windows). http://social.technet.microsoft.com/wiki/contents/articles/32288.windows-enforcement-of-sha1-certificates.aspx http://social.technet.microsoft.com/wiki/contents/articles/3...
- huhtenberg 10y ago
  Just asked - signed with an EV cert using SHA2.

userbinator 10y ago

You can also find various stories of AVs detecting perfectly clean Hello World programs as "malicious". One example I remember particularly clearly was a beginner who had just downloaded GCC and was starting to learn C, and wondering why the executable kept disappearing. It was his AV. Ironically, the same code compiled with MSVC didn't get detected... The other category of software that frequently gets false positives are demoscene productions, which admittedly do push the boundaries and can involve things like custom packers and unorthodox API usage, but are certainly not malicious by any definition. Of course there's also the cracks/patchers/keygens, which are not malicious to the user but are often detected as such anyway.

obsurveyor 10y ago
Just got a complaint yesterday of anti-virus software quarantining a file out of a users's .git folder, breaking the repo completely until they restored it.

ntauthority 10y ago

There's a difference between antivirus-induced removal (such as this, where it does not affect all users, and could be caused by a leftover of third-party antivirus FWIW) and a proper blacklist entry in the migration system Windows uses. The latter leaves no traces such as shortcuts/uninstall entries and actually shows a notification to the user; the former is as 'rough' as just removing the executable.

overgryphon 10y ago

Sounds like your friend ran into a bug. I don't see a reason to assume malicious intent unless Microsoft refuses to fix this issue.

TimJYoung 10y ago

I'm wondering if the issue is that the .exe isn't signed. Windows is getting a lot pickier about .exes and .dlls being signed with a cert, including wanting them to be signed with a SHA-256 cert in addition to the SHA-1 cert (which you'll want, for backward-compatibility with older versions of Windows). http://social.technet.microsoft.com/wiki/contents/articles/32288.windows-enforcement-of-sha1-certificates.aspx http://social.technet.microsoft.com/wiki/contents/articles/3...

huhtenberg 10y ago
Just asked - signed with an EV cert using SHA2.