Antiviruses or browsers download issue

1. Reason of these issues

1. The program is not signed (as I can't afford to buy annual certificates to make WinPaletter's executable file not from unknown publisher)

2. WinPaletter is editing Windows Registry in an extensive way

• So the browser, Windows and antivirus will tell you that the program is from unknown source\organization and may be harmful

• And this is a false positive in browsers and antiviruses

---

2. Scan attempts

Tested antiviruses	Result
Avast, Avast One	✅ safe
Kaspersky	✅ safe
Malwarebytes	✅ safe
SmadAV	✅ safe
BitDefender	✅ safe
Windows Security	✅ safe
Windows Security after patching imageres.dll to change startup sound	❌ Win32/Execution.A!ml

• Sometimes, you may face that the program is infected with IDP.Generic, SuspiciusBehavior or something else. If so, open your Antivirus > Updates > Update Definitions and then reopen WinPaletter after restoring it from quarantine

• If it still infected, create a new issue with descriptions in it and I will send this app for antivirus (that has the problem) developers for a deep analysis

---

3. Causes of Windows Security (formerly Windows Defender) detection:

1. Registry key modification:

HKCU@S-1-5-21-957280099-1924274324-3775045331-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WinPaletter

2. Patching imageres.dll to change startup sound is considered as a malware action for Windows Security

• Microsoft deep analysis found it clean

  • Submission ID: 90ed38b7-6df9-44fa-aa9f-387b2eb1b7c0
  • Analyst comments: At this time, the submitted files do not meet our criteria for malware or potentially unwanted applications. The detection has been removed.

• Even if Windows Security found WinPaletter clean, a Win32/Execution.A!ml detection will popup when you patch imageres.dll to change startup sound

• You may need to do extra steps to remove this suspicion:

  1. Run Command Prompt as administrator and enter the following lines

  CD C:\Program Files\Windows Defender
  MpCmdRun.exe -removedefinitions -dynamicsignatures
  MpCmdRun.exe -SignatureUpdate
  

  2. Update your Windows from Settings

---

4. Browsers download issue

• Some browsers like Edge and Firefox will prompt you that the program may harm the computer. It is a false positive and you can download it anyway.