Free42 flagged as virus in Windows?

[Thomas Okken]

I have received a report that the latest Free42 is being flagged as a virus by Windows Security. This wouldn't be the first time — in the past there have been false positives with Free42 Decimal (though not Free42 Binary, interestingly enough), which I was eventually able to silence by submitting the app to Microsoft's web verification service. That service performs a more thorough check and if an app checks out then they update their virus recognition database accordingly.

What's different about this latest report is that I am unable to reproduce it. I ran Windows Update in my build VM (Windows 10 1909) to get the latest malware definitions, but even after that, when I download Free42Windows.zip from my web site and unpack and run it, it is scanned but it runs just fine and is not flagged or quarantined. There is the usual warning about the app being from an unrecognized publisher — no surprise because it is unsigned — but once I say "run anyway," everything seems fine.

Has anyone else gotten complaints about Free42 from Windows Security lately? And if yes, under which version of Windows?

[mwthomasjr]

(10-27-2020 01:15 PM)Thomas Okken Wrote:  Has anyone else gotten complaints about Free42 from Windows Security lately? And if yes, under which version of Windows?

I have not seen any Windows security errors, at least not with the last two versions, 2.5.20 and 2.5.2.

Edit: Running Version Windows 10 Home: Version 1909, Build 18363.1139

[Nigel (UK)]

I've just downloaded Free42Windows.zip. I decompressed it and then ran the Free42 Decimal version. I got a "Windows protected your PC" message saying that I was trying to run an "unrecognised app". The default choice offered was "Don't run" but on clicking "More info" and then "Run anyway" it ran.

Subsequent runs happen with no problems.

Nigel (UK)

Edit: I have Windows 10 v 2004/

[rprosperi]

(10-27-2020 01:15 PM)Thomas Okken Wrote:  What's different about this latest report is that I am unable to reproduce it. I ran Windows Update in my build VM (Windows 10 1909) to get the latest malware definitions...

You should update the VM to Win-10 2004, or better yet, 20H2. Though one might not expect a different OS version to cause security s/w to behave differently, it can and does, which may not really be that strange after all since Windows Security actually is part of Win-10. Some 3rd party AV products may also act differently on different OS versions, it's not just WinSec.

I'm not saying that this is the issue in this case for sure, but until you're on the latest, you can't rule out differences.

[Thomas Okken]

(10-27-2020 05:30 PM)rprosperi Wrote:  I'm not saying that this is the issue in this case for sure, but until you're on the latest, you can't rule out differences.

Good point... But even after upgrading to 20H2, still no complaints from Defender.
I guess I'll have to tell that user that there's something wrong with his PC and that he should reinstall Windows. ;-)

[rprosperi]

(10-27-2020 10:48 PM)Thomas Okken Wrote:  

(10-27-2020 05:30 PM)rprosperi Wrote:  I'm not saying that this is the issue in this case for sure, but until you're on the latest, you can't rule out differences.

Good point... But even after upgrading to 20H2, still no complaints from Defender.
I guess I'll have to tell that user that there's something wrong with his PC and that he should reinstall Windows. ;-)

It's also possible (in fact, more than likely) that all the scanning of this same file has 'taught' the MS cloud that this file is really OK. Have the user try scanning it again, it more than likely will pass now.

[firai]

Besides the Windows version, Defender also has its own set of engine and definition version numbers and updates. I'm still on Windows 10 version 1909 due to a version block on 2004, but the Defender versions have been updated to the versions listed below, which are the latest based on the MS documentation I can find. I'm not using Defender real-time protection since I have another antivirus, but I ran an on-demand scan on the Free42 v2.5.21 zip file using Defender, and it didn't complain.

Windows 10 Pro 1909
Antimalware Client 4.18.2009.7
Engine 1.1.17500.4
Antivirus 1.325.1582.0
Antispyware 1.325.1582.0

These version numbers can be found through Windows Security → Settings (in the lower left) → About (near the bottom). The user might need to at least update Defender through Windows update if he/she is still having problems.

[Thomas Okken]

I have had no problems with Windows 10 Home 1909, Windows 10 Home 20H2, Windows 10 Pro 1909, and Windows 10 Pro 2004, all with the latest antivirus and antispyware definitions. As Bob suggested, the most likely explanation appears to be that Free42 was considered malware in some version of the antivirus definitions but that was fixed almost immediately, without me doing anything and before I even looked into it. I recommended to the user to run Windows Update and try again, and unless I hear back from him, I'll consider the case closed.

Thanks to all for your help!