Antivirus behavior while applying settings

[LeonzioMT]

Hi, i've just discovered this awersome project, downloaded and run, setting full red colors instead of the washed out salmon. While i was applying bitdefender blocked the app as malware and deleted it.
Why did this happened?

[Abdelrhman-AK]

There are two explainable causes, but I don't know the exact cause why BitDefender blocked it exactly:

1. The application is not signed, so the antivirus will detect that the application is from unknown source.
2. The application is editing Windows Registry extensively, and so the antivirus may detect the actions as malware.

Can you send me the screenshot of the antivirus with detection details?

[LeonzioMT]

Unluckily Bitdefender does not allow me to extend the app to make all the infos fit in a screenshot, but i'll transcribe all:
"winlogon.exe has executed the process userinit.exe;
userinit.exe has executed the process explorer.exe;
explorer.exe signed by Microsoft Corporation has executed the process winpaletter.exe;
Bitdefender has detected a potentially harmful behavior and has blocked all applications involved. ID detection: SuspiciusBehavior.AF62DFEF33C3034B".
Than says: "23 apps have been blocked: WinPaletter.exe (Malware)" and multiple times: "reg.exe, conhost.exe, taskkill.exe, explorer.exe".
These are the only available informations i'm able to get.

My guess is that it went crazy because i've applied color changes two times in a single minute (so 8 modifications each, if i remember right)

[Abdelrhman-AK]

• reg.exe is used only when access to HKEY_LOCAL_MACHINE is denied/without administrator elevation (As a deflection method). You can see this in theme applying log, it will tell you that you are not starting WinPaletter as administrator.

• Taskkill.exe and explorer.exe both are used in restarting the Explorer.

• Conhost.exe is used in all .net framework applications

My guess is that it went crazy because i've applied color changes two times in a single minute (so 8 modifications each, if i remember right)

Actually applying multiple changes in a short time is not a problem.

WinPaletter modifies the registry if a value is changed (If comparison done without issue it will write to registry, but if there is an error during comparison, it will write to registry anyway) and so assuming that you made 2 changes to registry, there will be more than two writes (neither equal nor less).

• Before I released the first version of WinPaletter, I tested it on another devices, Avast thought that WinPaletter is a malware. I searched for virus detection code and I knew that its due to false positive issue (and the application is not signed)

• After I released the first version, I sent it to Avast for analysis. They found it clean and told me to update the virus definitions database and try again and the problem is solved.

• Malwarebytes found it clean from the first time.

• I have sent WinPaletter to BitDefender to analyze it, and I think it is the same issue; false positive and unsigned application.

• Here you are a link to BitDefender false positive information and analysis: https://www.bitdefender.com/consumer/support/answer/29358/#:~:text=It%20occurs%20when%20a%20program,as%20a%20false%20positive%20threat

[Abdelrhman-AK]

It is a false positive:

This detection will be removed in the next 72 hours. Keep BitDefender updated in the next days and try again

[Abdelrhman-AK]

Can you tell me if this issue persists or not?

[LeonzioMT]

I've tried using it one more time now and it works fine :)

[Abdelrhman-AK]

OK. That is great!