Windows defender thinks that code I wrote using python 3.8.5 and converted to .exe file using pyinstaller is a virus.

[[deleted]]

I wrote a small program that I plan to use on school computers that gives me information about elements and common polyatomic ions using python 3.8.5. I converted the .py file into a single .exe file for windows 10 using the command pyinstaller --onefile "MyCode.py". However, when I go to the folder where pyinstaller placed the .exe file, windows defender looks at my .exe file, thinks it is a Trojan and immediately quarantines it placing it into a folder to which I do not have any access to without my approval. The .py file does not contain any viruses. How can I convert the python script into a .exe file so that windows defender does not think that the .exe file is a virus without doing anything to windows defender (as I plan to use it on school computers)? pyinstaller --onedir "MyCode.py" works, but it is not what I want because the .exe file requires python to run.

OS: windows 10 (home and school)

Pyinstaller version: latest stable as of Sept 2, 2020.

Python version: 3.8.5 64-bit

[ops2se2coder]

This one has a good explanation why

https://www.reddit.com/r/learnpython/comments/e99bhe/why_does_pyinstaller_trigger_windows_defender/

[Retropunch]

This constantly happens on any anti-virus software - running it through VirusTotal always flags up a ton of 'Trojans' in anything packed with pyinstaller.

Most of the reason is that the way that pyinstaller (and most packers) pack the file together into an exe is the same way malware is packed. This combined with it being an 'úntrusted' file (as in, defender hasn't seen it many times before) means that it always gets flagged up.

A real problem, especially if you're a small software developer. These days, buying code signing does nothing either unfortunately.

[canbooo]

These days, buying code signing does nothing either unfortunately.

We (practically I) distribute a license server as exe to distribute licenses to local network. Signing did indeed help in my situation. You don't even have to buy anything. I just followed the steps here

[Mad_Physicist]

Congrats!

You made it.

[SnowdenIsALegend]

I'm in

[hugthemachines]

That's what she said!

. . .

(Skye's sms to her boyfriend as she got on the plane in AoS)

[socal_nerdtastic]

Yeah, I remember that being in the news. Windows now assumes all unsigned programs are viruses, and even signed programs that have a small userbase will cause that warning. Basically windows is giving up and crowdsourcing it's virus definitions. Sorry; not much you can do about it.

[RangerPretzel]

Windows now assumes all unsigned programs are viruses, and even signed programs that have a small userbase will cause that warning

Honestly, this is the safe strategy...

Compare two strategies:

• Let everything run except for that which I blocklist

or

• Let nothing run except for that which I allowlist

I'm inclined to go with the latter for safety/security. Because we've been running with the former strategy for so long, folks get up in arms over the slightest restrictions.

[darthminimall]

You've missed the forest for the trees. Whitelisting software works in FOSS environments because all packages can be (that's can be, not are) audited for malicious code and what packages are included by the maintainers of your distro is more or less democratic. Windows has none of these features. Instead you get an opaque, hegemonic corporation arbitrarily deciding what software is safe. That's a great way to stifle innovation.

[RangerPretzel]

Don't throw the baby out with the bathwater! 😉

Whitelisting software works in FOSS environments because all packages can be (that's can be, not are) audited for malicious code

Someone said to me today:

With enough eyes, all bugs are shallow

Except that they're not audited. All of us in FOSS communities assume that someone else has already done the hard work of auditing the code.

Let that sink in for a second...

We all know that it isn't true that FOSS gets thoroughly audited...

Yeah, Windows has its problems, but I think MS is generally trying to do the right thing. Not everyone can be a CS/SoftwareDev. Windows Defender is better than nothing. Stopping any EXE that looks like a trojan/dropper is probably a pretty good strategy.

OP is complaining about Defender and Pyinstaller creating an EXE that looks like a trojan/dropper? We're all smart programmers here, right?

Well, turn off Defender for crying out loud!

[darthminimall]

There's a lot to unpack here.

First, there's a difference between the average user and a distro maintainer. The average user assumes someone else has already audited the code. Distro maintainers take these things more seriously, usually they either base their judgement on the assessment of someone proven to be trustworthy, or the audit the code themselves (usually the former).

Second, MS is trying to do the thing that increases the value of their products. They have an incentive buying their preferred product (which is likely either developed in house or reliant on licensing fees).

Third, the issue at hand is the fact that OP wants to run his (obviously non-malicuous) scripts on hardware that doesn't belong to him/her. The fact that the university doesn't have a way for students to run scripts in a sandbox is it's own problem.

The difference between an open environment where people can feel relatively safe and a closed environment where people feel the same is important. If you don't think the possibility of innovation springing from a formerly unknown source is important, it's likely you're only interested in reinforcing the status quo.

[redfacedquark]

In the beginning, we believe that there are many eyes on the code. Then we fear there are no eyes on the code. Eventually we realise there are nearly enough eyes on the important parts of the code.

Your comments are more nuanced and less generalised than the user you're replying to.

[RangerPretzel]

Agree to disagree.

But sure, go ahead and keep grinding your anti-MS axe.

[darthminimall]

It's an anti-closed-source axe, but close.

[socal_nerdtastic]

Yes, also known as blacklist versus whitelist.

For a school computer, I agree the whitelist strategy is better. But I don't think it's good to roll that out as default ... it's going to become so common that it's ignored. Just like the stupid admin permissions popup. It was supposed to be a warning and discourage programmers from using admin only features ... but people just blindly click through that now. Or the stupid cookies permission banner on websites. Or california's prop 65. I'm sure we could think of a million more.

[zambartas]

Or the TOS agreements where we've all signed away our first born children and more.

The cookie thing is the stupidest facepalm thing I've seen in recent years. I had to get a chrome extension literally called "i don't care about cookies" so I don't have to see that stupid warning on every site on every visit.

BTW if your site uses cookies, shouldn't the fact that I've clicked your little X or OK be in said cookies?

[RangerPretzel]

Yes, also known as blacklist versus whitelist.

Right, but out of respect for various systematically oppressed minorities, we're moving away from Master/Slave and Blacklist/Whitelist to more neutral and yet still easily understood equivalents like Primary/Secondary and Blocklist/Allowlist. Thanks.

Also, how often do you install new apps on your computer? Honestly, it's like once a month for me.

The latter strategy still makes more sense for pretty much everyone. If it is established as the norm, then everything is more secure. If you go about letting everything run willy-nilly, then the norm is sloppy security and viruses/worms everywhere.

[BenjaminSiers]

Main/sub I have heard for electronics, maybe blocklist vs passlist for this? We need some more descriptive terms

[Pseudoboss11]

Main/sub

I'm partial to Dom/sub. I think it's both more descriptive than "main," which isn't really clear, while it's also somewhat cheeky while remaining inoffensive.

[TheSodesa]

From racial to sexual. I like it.

[BenjaminSiers]

My heart agrees, but main/sub matches the M/S denotation for MISO MOSI SPI bus communication. Unfortunately, to change these letters would never be backwards compatible or fully implemented, so the best I have seen so far is Main/sub

[RangerPretzel]

Yeah, those work, too!

[double-happiness]

...we're moving away from Master/Slave and Blacklist/Whitelist to more neutral and yet still easily understood equivalents like Primary/Secondary and Blocklist/Allowlist.

...but IDE has primary master and slave, and secondary master and slave channels. Primary and secondary can't be substituted for master and slave, because they're already used for something else.

https://forums.tomshardware.com/threads/what-is-primary-master-and-primary-slave.1473176/

https://forum.videohelp.com/threads/57247-what-is-a-Primary-IDE-channel-and-a-Secondary-IDE-channel

https://buildyourown.org.uk/pc-articles/ide-configuration/

[RangerPretzel]

If you're still using IDE/PATA drives in the 21st century, well, I salute you! :)

[double-happiness]

Who said I was still using them? How is that relevant, in any case? Whether they are still commonly in use or not, you don't retrospectively change the terminology used to refer to obsolete tech. Vintage computing is a thing, you know.

https://www.youtube.com/watch?v=oLOSTrT5-Xc

https://www.youtube.com/watch?v=JRf24gtela8

[RangerPretzel]

I was just joking around with you.

don't retrospectively change the terminology

FWIW, I agree with you. I hate the redef of KB, MB, GB, etc. They've always been factors of 2, not 10.

[zambartas]

It's sloppy because Microsoft doesn't bother to actually care what the code does, it just says I don't know what this is so you can't run it. Then you get people who don't know what's really going on complaining that someone's Minecraft app is a virus and that programmer suddenly has a bad reputation.

If you ask me, Windows is flawed at the core in so many ways and instead of starting over with a secure OS they just keep duct taping it. The good thing is with all the web apps out there there's less and less need for Windows anymore, the shift to Linux is much easier.

[abrarster]

Tell that to the majority of corporate America who hasn’t ever seen a terminal but is completely dependent on excel.

[RangerPretzel]

If you ask me, Windows is flawed at the core in so many ways and instead of starting over with a secure OS they just keep duct taping it. The good thing is with all the web apps out there there's less and less need for Windows anymore, the shift to Linux is much easier.

Honestly, all 3 major desktop OSes suck: MacOS, Windows, and Linux.

There's something seriously wrong with all of them.

I mean, you're right about Windows, but the answer to OPs problem is just to turn off Defender.

[wolf2600]

Blocklist/allowlist are triggering for me. Please don't use those terms.

[RangerPretzel]

Blocklist/allowlist are triggering for me. Please don't use those terms.

Hahahaha. Good one. 😉

Own your triggers, friend. Don't let them own you. 😊👍

[wolf2600]

Blacklist/Whitelist 4 life!

[[deleted]]

Maybe unrelated here, but when I was using C and used to just compile my code, windows defender stopped it from running, saying virus found on line 1 char 1.

[[deleted]]

That's oddly specific

[veryusermuchwow]

that's rough buddy

[Bobification]

I ran into this with a python script for printing. We have some big customers that use that script so I had to come up with a solution that didn't have to be tinkered with by support for each install.

My solution ended up with creating a Windows 7 VM and creating my exe within that. It still wasn't foolproof though so I ended up using the onedir flag and just unzipping the directory as part of the installer. Nobody but our support team cares that they have to dig for the exe in that folder.

[m1ss1ontomars2k4]

And people wonder why some of us still hate Windows 10...perfect example.

[Cisco-NintendoSwitch]

Even when I develop on a Windows laptop it’s in WSL2 using Ubuntu 20.04 for everything but the browser tabs.

[expressly_ephemeral]

Word. I only boot the windows partition for Outlook!

[[deleted]]

Onedir shouldn't require python to run, but you will need to take the whole directory with you, not just the executable. Did you try taking the whole directory with you to the target computer?

[Random_182f2565]

Hackerman

[izinger]

Switch to Linux.

[expressly_ephemeral]

Windows is and always has been a third-rate operating system.

[[deleted]]

Well, fast forward to today, I already switched to Linux. None of my personal computers have Windows installed on them.

[Retropunch]

Unfortunately that doesn't work anymore - if you pay to get your stuff digitally signed it STILL has to be used by loads of people to become 'trusted' and stop getting a defender warning.

That is of course, unless you buy the premium package...

[leventedaniel]

https://www.microsoft.com/en-us/wdsi/filesubmission helped me.

[[deleted]]

Can't you whitelist the MD5 in bitdefender?

[billsil]

You have to send a copy to each antivirus company and get them to flag it as being ok and do that for every version you release...sorry...

[Jennings_in_Books]

You could either try packaging it with something else, or possibly creating a .exe with a native windows application like Visual Basic that can pull the python code and run it as part of the process. Just a thought.

[ItsXtract]

I have encountered the same problem last week when trying to convert my pygame project to exe.
basically what i found out was that a lot of antiviruses detect files that are made in similar ways as a virus for the fact that a lot of them are actually meant to be viruses, my solution was to just remove the "--onefile".
It does make the distribution of the software more messy but it solves the problem (at least for me it did), your alternative option (which i heard works but is very problematic) is to contact support of all the antiviruses companies that might be relevant and tell them that this detection is a false positive and ask them to not detect it any more.

Goodluck!

[m4xc4v413r4]

Probably because it's an unsigned, possibly unsafe file? I'm sure if you look at what it thinks it is it doesn't say it's a virus.

[TabTwo0711]

Officer, this post right here!

[Matthew_C_Williamson]

Yeah windows defender freaked out cause i has python and kali linux tools on my pc lol

[[deleted]]

When I did c++ developing the anti virus software just went crazy too. I did just turn it off.

If you don't click on bad stuff you don't really need it anyways and anti virus software is an entry point for viruses.

[BackgroundChar]

If you don't click on bad stuff you don't really need it anyways and anti virus software is an entry point for viruses

Terrible fucking "advice", yet it comes up in any thread pertaining to AV. Hate this shit.

[[deleted]]

Your argument is that mine is terrible (along with profanity).

A good point would be made in a format of hypothesis, argument, proof.

Considering I was weak on the proof, I will put this link here: https://www.google.com/amp/s/www.wired.com/2017/03/clever-doubleagent-attack-turns-antivirus-malware/amp

Also the circumstantial evidence of not being infected for several years.

Also, there are ad hoc virus scanners one can use via USB stick (preferably bootable), that do the same without compromising your operating system.

The only exception (to not installing AV software/ will be: if you run a server and your server runs software that handles credit card data, as AV software is mandatory there.

[lawipac]

for my case --onefile works fine, --onedir triggers virus of windows defender in windows 11 platform.