I just installed StopThePed and, Realistic conversations for stop the ped, and when I start RPH I get a trojan warning from Microsoft defender. I presume it is a false positive, but I would rather be safe than sorry. Here are some details from Microsoft Defender.

 

Detected: Trojan:Script/Wacatac.B!ml

Status: Quarantined

Details: This program is dangerous and executes commands from an attacker.

Affected Items:

file C:\Users/(username)\AppData\Local\Temp\(then a whole bunch of folders named random letters and numbers)

-It repeats this around 60 times but the folders are named different random numbers and letters.

Should I be concerned? Thanks in advance!

 

I found another thread saying its normal after an RPH update and lasts about 2 weeks.

Edited June 30, 20241 yr by Clay8187

I feel like it's false positive. Had the same thing pop up and disappear. Ran multiple scans and not finding anything now.

Just now, anqrw said:

I feel like it's false positive. Had the same thing pop up and disappear. Ran multiple scans and not finding anything now.

I read its a normal thing for about 2 weeks after an RPH update. So just turn off real time protection and it should work fine.

Just now, Clay8187 said:

I read its a normal thing for about 2 weeks after an RPH update. So just turn off real time protection and it should work fine.

Yes, it is. Microsoft does not like the fact RPH is unsigned and when an update is pushed out, multiple people run it, and it flags as an anomaly to Windows Defender. 

2 minutes ago, Cyan said:

Yes, it is. Microsoft does not like the fact RPH is unsigned and when an update is pushed out, multiple people run it, and it flags as an anomaly to Windows Defender. 

So should I just disable windows defender altogether or is there a way to allow RPH to run on the PC?

2 minutes ago, Clay8187 said:

So should I just disable windows defender altogether or is there a way to allow RPH to run on the PC?

You can temporarily disable Windows Defender until RPH finishes loading, or if you have doubts, cease using LSPDFR/RPH until Microsoft corrects their error.