DLL is marked as flaged as malicious by some antivirus products

[bostjanc8310]

When uploading DLL to virus total I get marked as malicious?

Print screen below:
https://drive.google.com/file/d/1-xfrwrish3DNc__dhb3klrEoknv5wAtu/view?usp=sharing

[valinet]

From #56:

The documentation is posted there for a reason. PLEASE, take the time to read the documentation [...]

From https://github.com/valinet/ExplorerPatcher/blob/master/README.md, section "A note on antivirus false positives":

The DLL you download may trigger a false positive alert in your antivirus program. This is fairly normal, a sign that the product you are using is decently capable, since it features detection methods a bit more advanced than what was state of the art in 1999. The program being flagged is usually done through heuristic analysis, not via a database of know viruses. That means that the antivirus program thinks that due to the nature of the code in this application, it likely may be a virus, a program that the user does not really mean to run. Injecting code into other executables is rarely done by legitimate programs. One such kind of legitimate programs is this patcher, that you deliberately choose to run and let it alter Explorer's code and memory in a controlled manner so that you achieve a certain effect. Thus, this patcher falls in the category of false positives: your antivirus thought such a program was not something you meant to run, but that's not the case this time.

If you still feel a bit iffy running this, then that's why the source code is available on the web site. You can take a look and even compile the DLL yourself and make an informed decision when running the software. Never run untrusted binaries from questionable sources, especially when you lack access to the source code and a way to reproduce that binary.

Thanks

[amakuramio]

I am not sure, I installed this and it changed my crypto currency address from something I didn't copy at all, as if it could read my clipboard. After a scan and removing dxgi.dll, and rebooting the behavior stopped. Can someone try to replicate this issue?

[valinet]

So, what's the actual behavior? Is it reproducible, if then, how? Has it happened more than once for you, if yes, what triggers it? The clipboard is a shared, untrusted location where every app can read from or write to whenever it pleases, so it is not for sensitive data. As far as the patcher is concerned, it never messes with the clipboard directly, but who knows, maybe it is indeed happening sometimes, by accident, although I very highly doubt it until I see some evidence. Again, as mentioned in the README, it's normal such an application to be flagged by an antivirus. But in the case of ExplorerPatcher, ALL the source code is provided, nothing stops you from compiling your own build and running that, provided you review and trust the code. Other than that, I don't know what else to say. I wish the compiler would produce reproducible builds, that way, 3 of us members here let's say could compile each and every release and then only publish it if the checksums of the 3 files we obtained independently matched. This guarantees that nothing interfered between the source code and the binary, besides the compiler/linker. And if that's broken, well, we have bigger issues...

[bostjanc8310]

@amakuramio - waiting for your reply?

[bostjanc8310]

@amakuramio still waiting for a reply?

[amakuramio]

I'm waiting for others users input. I did a reinstall with the dll only, no weird behavior as of yet.