Can't compile script: Windows virus alert

[zvit]

I'm trying to compile a small script but Windows is screaming about a Trojan and won't let it compile. Screenshots below.
Any idea what to do? (Is it possible that a Visual Studio Code extension is causing this?)
.

explorer_3tBrQCWyyX.png (8.17 KiB) Viewed 1537 times

Ahk2Exe_6kwPTcma5F.png (7.85 KiB) Viewed 1537 times

ApplicationFrameHost_aS8FcXAlap.png (21.34 KiB) Viewed 1534 times

[mikeyww]

I think there is a way under Actions or in Defender settings to exclude or allow the program. You can also exclude an entire directory if you wish.

[zvit]

I already had the entire F: drive excluded. I think because the virus is reported as being in the temp folder of the C: drive, that's why my F: exclusion is not working. I of course won't exclude the temp folder as many viruses use that folder.

[MrDodel]

I already had the entire F: drive excluded. I think because the virus is reported as being in the temp folder of the C: drive, that's why my F: exclusion is not working. I of course won't exclude the temp folder as many viruses use that folder.

First I would look into running both the below apps, this will ensure you are virus free, I would also run over your F:\ given you've disabled any protection on it.

Run "disk cleanup" from the start menu (As admin)

https://toolslib.net/downloads/viewdownload/951-kprm and https://www.malwarebytes.com/adwcleaner - I am not affiliated with either.

Some light reading : https://unboxhow.com/cybersecurity/remove-trojanwin32-wacatac-virus

Odds are it's an false positive and defender needs an definition update, however better to be safe than sorry.
How to report False Positives : viewtopic.php?f=17&t=62266

In regards to your issue, once you've confirmed that your system is clean, I would disable defender, try to compile again.

Good luck!

[TAC109]

You can stop Windows Security from complaining in this way by adding Ahk2Exe.exe as a process to the Security exclusion list.

Navigate from Settings -> Update & Security -> Windows Security -> Open Windows Security -> Virus & threat protection -> Manage settings -> Add or remove exclusions -> Add an exclusion -> Process -> Ahk2Exe.exe.

[zvit]

You can stop Windows Security from complaining in this way by adding Ahk2Exe.exe as a process to the Security exclusion list.

Navigate from Settings -> Update & Security -> Windows Security -> Open Windows Security -> Virus & threat protection -> Manage settings -> Add or remove exclusions -> Add an exclusion -> Process -> Ahk2Exe.exe.

This makes sense! Ok, I'll try this next time I have the issue. It doesn't happen all the time and it's not happening now.

[SOTE]

@zvit
I would suggest that you submit your AutoHotkey files (autohotkey.exe, ahk2exe.exe, etc...) to Microsoft as a false-positive to see what their assessment of it is. This includes submitting any other files that you are suspicious of. You do not want to just make blanket exceptions/exclusions, without being reasonably sure. It can be possible for some 3rd party program to replace your legitimate AutoHotkey files with fraudulent ones. If your AutoHotkey files are genuine, Microsoft should confirm that or acknowledge they made a mistake and will correct their database (which is good for all of the AHK community).

[JoeWinograd]

You can stop Windows Security from complaining in this way by adding Ahk2Exe.exe as a process to the Security exclusion list.

Hi TAC,
Thanks for that advice! I just ran into this problem after the latest Windows 10 Patch Tuesday update. In my case, I also had to exclude the BinMod.exe process, as I use it for several compiler directives. Regards, Joe

[TAC109]

@JoeWinograd
Yes, you can perpetually fight the false positives, or just use the provided tools to fix the problem once and for all.

Cheers!

[JoeWinograd]

just use the provided tools to fix the problem once and for all

Hi TAC,
I must have missed that along the way. What tools will fix the problem once and for all? Thanks, Joe

[TAC109]

Oh, I’m just referring to being able to use the Windows Security 'exclusions', 'process' setting to stop the false positives.

Cheers

[JoeWinograd]

I’m just referring to being able to use the Windows Security 'exclusions'

Ah, OK, I misunderstood. I thought you were saying that using the Windows Security exclusions was the way to "perpetually fight the false positives", but now I see that you mean it is the way to "fix the problem once and for all". Cheers, Joe