11 ms·
I recently unpacked an old archive from the time I was making some shareware few decades ago. Windows Defender instantly ate all keygen.exe files from it. Those
by kozak 5y ago
I recently unpacked an old archive from the time I was making some shareware few decades ago. Windows Defender instantly ate all keygen.exe files from it. Those keygens were my own keygens for my own software (I wrote them myself and used them to generate keys for my customers back in the day).
- sdoering 5y agoWow. Any idea why?
- efdee 5y agoMany virusscanners do this, arguably because as an employer you would want to block your employees from running them.
- arthurcolle 5y agoLmao - WHAT? On his own computer, not with any (based on the post) added certs? Madness
- gruez 5y ago>Oh his own computer Company machine is implied.
- arthurcolle 5y agoYou're right, I re-read and that's clear now.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- ethbr0 5y agoI'd also be curious what happens if you rename them to {not-keygen}.exe I'd hope it wouldn't make a difference, but my experience with IT security thinking makes me bet the other way.
- httpsterio 5y agoIt sadly doesn't make a difference. I have about a dozen keygens on my machine and they get quarantined unless they're zipped behind a password or zipped into a 7z. Just downloading a zip with a keygens inside, it gets removed from the zip before even unarchiving it.
- ethbr0 5y agoAlso, AFAIK by spec, the manifest of a zip file is unencrypted, even if the zip "is". Most scanners are too brain dead to care, but I have come across a few that still quarantine if the manifest lists a file with a blacklisted extension. Easy solution? Compress to zip, then compress that zip to another zip, with a password. (Yes, I've spent far too long trying to get work done underneath insane corporate security policies)
- 13of40 5y agoGmail will block you from sending a a password-protected ZIP with anything potentially bad in it, like an EXE, because they can see the individual file headers and central directory, like you say. Unfortunately, if you have a ZIP inside a passworded ZIP it also gets considered dangerous and blocked.
- josephcsible 5y agoHere's a workaround: rename the .exe file to a .txt file, then put that in a password-protected zip file. Now braindead security scanners have no choice but to believe that it really is a text file.
- indigochill 5y ago
- habibur 5y agoThat's fall out from the 90s. People hunted for keygen.exe for their sharewares. And some rouge sites will collect many keygens, attach backdoor program with those and then distribute from their site or over bit-torrent. Anti-virus then would scan those files. Looks like modern ones simply delete any such named file without scanning.
- 0x0nyandesu 5y agoAnd this is why the first thing I do with winblows is disable defender. So much for that.
- hulitu 5y agoIt serms that antiviruses today have only antifeatures. The last time i saw an antivirus detect malware was more than 10 years ago. Now the only protection against viruses is common sense, a good backup and another OS to recover what's left after the disaster strikes.
- UnFleshedOne 5y agoThe problem is that you also need backup bank accounts and probably a backup identity after disaster strikes...
- hulitu 5y agoThis depends on your online presence. Even if malware touches my computer it has no access to bank accounts and the amount of personal info is low. I still have to find a better email provider than yahoo or gmail for receipts.
- 0x0nyandesu 5y agoHonestly I've been over it for years. I do real work on Linux and MacOS. Windows is for a handful of games I can't play on Linux. Everytime I try to use windows for work I end up with issues caused by windows update that blows out chunks of my work day.
- Y_Y 5y agoDid you have catchy chiptunes and graffiti ANSI art?
- kozak 5y agoI anticipated this question :) No, it was just a plain Windows form, built from scratch using a then-popular Windows IDE. I think it was mostly triggered by the file name, maybe in combination with some crypto code inside.
- magicalhippo 5y ago> using a then-popular Windows IDE If you're referring to Delphi, this has been a common issue for a long time. Delphi seems to have been very popular with malware writers, and so AV companies keep flagging stuff from the standard libraries as malware. Got so bad at one time that some tried to get a deal with the major AV players to provide a suite of very basic Delphi applications they could use for false-positive testing.
- kozak 5y agoThis is so sad.
- nitrogen 5y agoNSIS installers used to get flagged as malware occasionally, too. Was very frustrating for distributing software.
- ampdepolymerase 5y agoWhat about pre-.NET VB?
- magicalhippo 5y agoThose required prerequisites in the form of the VB runtime, so AFAIK not so popular. Also more limited or difficult to use in terms of writing malware.
- Synaesthesia 5y agoYes that's why you have to unzip them on a Mac or Linux PC first. It does the same for Windows Loader by Daz and similar activation cracks for Windows 7/10.
- AnIdiotOnTheNet 5y ago...or you just disable Windows Defender.
- Wowfunhappy 5y agoWhich you can’t do permanently anymore.
- tomatotomato37 5y agoYou can also just whitelist it. It's how I maintain my LTSC variant
- mikewhy 5y agoAnother option is using a folder you've added to defenders exclude list: https://support.microsoft.com/en-us/windows/add-an-exclusion-to-windows-security-811816c0-4dfd-af4a-47e4-c301afe13b26 https://support.microsoft.com/en-us/windows/add-an-exclusion...
- adriancr 5y agocheck if there's any trojan appended to them... or if you've used UPX to package them then they will automatically get flagged.
- colejohnson66 5y agoWhat’s the deal with UPX compressed executables being “dangerous”? Is there self modifying code or something?
- adriancr 5y agoit used to be a very common way to append trojans to existing executables. First pack them then add small payload (ones i've seen were usually ~20kb in size) Then antiviruses took an easy way out and marked all as viruses for some reason...
- thunderbong 5y agoThis happened to me as well. Even when those keygens were in zipped files, Defender would flag them as malware and remove them automatically. The only solution I found to this was to keep the keygens in a password protected zipped files.
- zabatuvajdka 5y agoInteresting ideas here: how antivirus becomes a form of censorship. Maybe that’s an extreme view but it feels like now that Microsoft supplies it’s own defender app. And like all forms of martial law beginning as a way to protect citizens! I also noticed that with win10 when apps crash it sends the data to Microsoft—as though they can fix 3rd party apps for us. Yeesh. I think I’ll skip out on Windows 11 TYVM.
- kozak 5y agoPeople are downvoting the above comment for some reason, but what is this Windows Defender behavior if not a form of censorship?
- ethbr0 5y agoJudging. And it's impossible to build certain feature without judging. A lot of people here probably don't remember what email was like in the 90s/00s, before it got bad enough that Gmail's killer feature was (what we'd now call) cloud-enabled spam filtering. The distinction between judgement and censorship is the amount of user control. (1) Does the user know it happened? (2) Can the user override the decision?
- hulitu 5y ago1) no 2) no. So it seems a good idea to disable defender.
- colejohnson66 5y agoNot true. Defender alerts you when it quarantines a virus or whatever. And if you know what buttons to push, you can tell it to remove it from quarantine. You can also tell it to ignore folders if you so desire.
- integricho 5y agoOut of curiosity, which shareware programs were you developing back in the day?
- BizarroLand 5y agoIn the Windows defender settings, I believe under history actions or something similar (I don't have a PC running defender at hand) you can release and whitelist files it has placed in quarantine.
- badkitty99 5y agoIt's so disgusting how they police your local files and delete without any prompt, what a joke
- bobbylarrybobby 5y agoGives a new meaning to “software is eating the world”
- cptskippy 5y agoNot to condone it's stupid behavior, but I believe it put them in Quarantine. They keep moving the setting location around but I believe the menu option to located them is called "Protection History" where you can see what action was taken and undo it.