Antivirus Software False Positives
- Thread starter Ryan Douglas
- Start date
@dgpolvani & @technoid
I got the same hit from Windows Defender the day that 9.5 dropped. I know it hit on 9.5.021.
I run a tri-boot Mac/Windows 10/Red Hat Linux. Yesterday, Bitdefender on the Mac partition zapped both Launcher9.exe from the program files directory and LauncherHelper9.exe from the common files directory of the Windows partition. Both as Trojan.GenericKD from the 9.5.024 update.
I have all three OSs locked down HARD and I haven't seen any evidence of actual infection, but with all the various virus protection softwares that are pitching fits it probably won't be as easy to resolve the false hits as a single report to any particular software company.
I got the same hit from Windows Defender the day that 9.5 dropped. I know it hit on 9.5.021.
I run a tri-boot Mac/Windows 10/Red Hat Linux. Yesterday, Bitdefender on the Mac partition zapped both Launcher9.exe from the program files directory and LauncherHelper9.exe from the common files directory of the Windows partition. Both as Trojan.GenericKD from the 9.5.024 update.
I have all three OSs locked down HARD and I haven't seen any evidence of actual infection, but with all the various virus protection softwares that are pitching fits it probably won't be as easy to resolve the false hits as a single report to any particular software company.
technoid
Well-known member
I'm running 9.5.024 and the launcher was hit but since I start RF with the exe file I figured I could still run it. I wasn't going to do anything because I planned to start reinstalling windows today but that didn't happen. But I just started RF with the exe and the sim runs fine so I still won't do anything because tomorrow I'll start reinstalling.
I'm also running 9.5.024 and Windows Defender re-quarantined the RF 9.5 Launcher again. This time it is different "malware" than last time around. It also is not the same one that was flagged by technoid's Windows Defender. I had released the launcher from quarantine earlier but this time I think I'll wait until we see what is going on. I also have RF 8 on my system and it is not flagged.
Tom
Tom
Thanks for the reports. I have submitted both the Launcher and LauncherHelper to Microsoft for review so they can update their definitions to avoid falsely identifying viruses in the current versions of those applications.
Previous versions of both applications (from 9.50.021) were submitted to Microsoft, but they treat the new versions that came along in 9.50.024 independently of the previous versions. Though they've been publicly released for about a couple weeks now, it appears a recent definitions change on the Windows Defender side caused it to start flagging them in the last day or so.
Funnily enough, as I was in the process of submitting the LauncherHelper for review based on technoid's report (and thank you for the screenshot, which gave me the info I needed to complete the submission!), the same alert that tharbin reported above popped up the Launcher in my own installation. So I submitted that immediately after.
Looking ahead we want to find a way to prevent this from happening. In the meantime, you can refer to my directions in post #1 for how to restore the applications that Windows has quarantined.
Previous versions of both applications (from 9.50.021) were submitted to Microsoft, but they treat the new versions that came along in 9.50.024 independently of the previous versions. Though they've been publicly released for about a couple weeks now, it appears a recent definitions change on the Windows Defender side caused it to start flagging them in the last day or so.
Funnily enough, as I was in the process of submitting the LauncherHelper for review based on technoid's report (and thank you for the screenshot, which gave me the info I needed to complete the submission!), the same alert that tharbin reported above popped up the Launcher in my own installation. So I submitted that immediately after.
Looking ahead we want to find a way to prevent this from happening. In the meantime, you can refer to my directions in post #1 for how to restore the applications that Windows has quarantined.
It's the same thing as before, but if you're feeling too uncertain, you could run RealFlight directly until this gets resolved on the Microsoft side. Hopefully it won't take terribly long.
With that said, it is worth pointing out that even after Defender stops flagging that .exe, it won't restore it for you. You'll still have to do that yourself following the directions in post #1.
Don't just copy the Launcher9.exe from your DVD. It will be the wrong version.
EDIT: Meant to also say that the RF8 version being ignored is expected.
Robert Willis
Member
Is there a location where we can download the Launcher9.exe file for version 9.50? Malware Premium has flagged the file and even though I marked it as safe when their software updated it removed the file.
BrokeDad
Well-known member
I had that happen on my work laptop too but luckily I had the program installed at home. Re-installing would have meant I'd need to load all of my custom content over again. If you know the exact version of your software (run the realflight.exe file and then click on Help - About to view it) one of us could email it to you after you PM us an address to send it too. I posted it once for someone but it was deleted as it could mess up people being the wrong one for their exact version. I have version 9.5.024 if that is the one you need.
12oclockhigh
Banned
You don’t need the file. The ONLY time I use the launcher is to update. Just use the real flight exe. You don’t need anybody to send you any file. How can you trust anybody you don’t know how to send you something legit?
Last edited:
Ryan,
Thank you. I will release it as quoted in Post #1 after the dust settles. I'm sure it's fine but I can just launch the program manually until then. The only reason I released it last time was to get the 9.5.024 update.
Robert.
I agree with 12oclockhigh about not sending launcher files to others. It may make sense to put a backup of your launcher on a USB stick or other media in case your AV/Malware software deletes it, and remember to refresh the copy if we get any new updates. Windows Defender just quarantines it so it can be restored.
Tom
Thank you. I will release it as quoted in Post #1 after the dust settles. I'm sure it's fine but I can just launch the program manually until then. The only reason I released it last time was to get the 9.5.024 update.
Robert.
I agree with 12oclockhigh about not sending launcher files to others. It may make sense to put a backup of your launcher on a USB stick or other media in case your AV/Malware software deletes it, and remember to refresh the copy if we get any new updates. Windows Defender just quarantines it so it can be restored.
Tom
Hmmmm,
I decided to just go ahead and restore launcher but it didn't work. It released but the "allow" step doesn't appear to take. Launcher doesn't show up even after a restart. Checking Defender again, it still shows up in my protection history but it has been released because when I go to the actions it gives the allow option instead of the restore/remove option. Selecting it again does nothing.
Just checked. Launcher is missing. Guess I should have taken my own advice...
I decided to just go ahead and restore launcher but it didn't work. It released but the "allow" step doesn't appear to take. Launcher doesn't show up even after a restart. Checking Defender again, it still shows up in my protection history but it has been released because when I go to the actions it gives the allow option instead of the restore/remove option. Selecting it again does nothing.
Just checked. Launcher is missing. Guess I should have taken my own advice...
The only solution I have hit on to keep everything in place is the same one I have used for decades with Windows. In this case, exclude the RF program directory from Windows Defender. Wait after an update release to see if there are problems. If not, update and remove the exclusion to allow WD to scan the executables as usual after you are reasonably sure that none of the other Guinea pigs died.
I run Windows in a sandbox with all updates disabled and the network monitored nearly always because I learned a long time ago how precious a stable Windows install is. When/if you achieve it, back it up! Twice! Also, I alpha and beta test for number of softwares and like bleeding edge hardware, so it pays to have a stable working version handy.
I run Windows in a sandbox with all updates disabled and the network monitored nearly always because I learned a long time ago how precious a stable Windows install is. When/if you achieve it, back it up! Twice! Also, I alpha and beta test for number of softwares and like bleeding edge hardware, so it pays to have a stable working version handy.
Why don't you just backup and restore the RealFlight 9 directory that's normally in your Documents folder? Shouldn't be any issue, since you would be installing the same version anyway.
As long as you make sure the option to uninstall custom content is unchecked, you should be able to uninstall and reinstall without affecting all your custom content. I could understand some trepidation with lots of imported content, though. A backup to another location should also work fine after being put back in place as long as the directories involved haven't changed.
A more general word about uninstalling in this situation:
If your LauncherHelper9.exe is missing, you will be unable to uninstall, since it's the thing that does the uninstalling (and there's more to it than just deleting the installation directory).
If your Launcher9.exe is missing, you could still uninstall by going through the Windows "Add or Remove Programs" control panel, since we set it up to spawn the LauncherHelper directly without going through the Launcher.
There is not currently a place to download specific versions of the Launcher. I'll look into providing that since this is becoming such a problem.
Ryan,
What directory is LauncherHelper.exe supposed to be in? I don't see it or Launcher9.exe in my RealFlight9 directory. I just looked at my RF8 to make sure I am looking at it correctly and it has its Launcher8.exe but no LauncherHelper.exe either.
Are you saying that I can't uninstall correctly without LauncherHelper? If not my only choice is to get a copy of Launcher9 (for 9.50.024) and LauncherHelper somewhere and try to get the allow to work in Defender.
Is LauncherHelper also version specific (i.e. - could I use the one from build 9.50.021)?
What directory is LauncherHelper.exe supposed to be in? I don't see it or Launcher9.exe in my RealFlight9 directory. I just looked at my RF8 to make sure I am looking at it correctly and it has its Launcher8.exe but no LauncherHelper.exe either.
Are you saying that I can't uninstall correctly without LauncherHelper? If not my only choice is to get a copy of Launcher9 (for 9.50.024) and LauncherHelper somewhere and try to get the allow to work in Defender.
Is LauncherHelper also version specific (i.e. - could I use the one from build 9.50.021)?
LpcRCPlane
New member
I just sent in a submission:
It seems that when Launcher9.exe Jumps to RealFlight9, McAfee seems to think it is a Virus spawning itself.
I was able to restore both Launcher9.exe and RealFlight9.exe but cannot find LauncherHelp.exe.
So, so far I can run RealFlight 9.5 but cannot get support, Help, or Update.
Hope this helps
It seems that when Launcher9.exe Jumps to RealFlight9, McAfee seems to think it is a Virus spawning itself.
I was able to restore both Launcher9.exe and RealFlight9.exe but cannot find LauncherHelp.exe.
So, so far I can run RealFlight 9.5 but cannot get support, Help, or Update.
Hope this helps
SCOTT SALA
New member
McAfee Livesafe is also removing the files when it does a security scan. I have added the files to the exclusion list and they still were removed during the last scan...