Far Cry 6 Message Board  

Im on Windows 11 Insider Build and Windows Security (Defender) kept blocking FC6 HF3 and HF4 trainers. 🙁
So I gave the suggested route a spin: 😇

- temporarily disabled Windows Security to actually get the trainer zip file onto my disk
- entered it into the exceptions
- reenabled Windows Security
- uploaded the file to Microsoft via the link inside Windows Security

Result was that the trainer HF4 is clean and the false positive was causes by a mere "lack of reputation". Here the original comments I received from a Microsoft analyst:
--------------------------------------------------------------------------------------
www.microsoft.com/en-us/wdsi/submission/a886ad52-c05e-4f02-bac2-05d2119f62c0

fc6-rubenst-3bb08b156b827a2.zip
Submission ID: a886ad52-c05e-4f02-bac2-05d2119f62c0
Status: In progress
Submitted by:
Submitted: Oct 19, 2021 19:11:11
User Opinion: Incorrect detection

Analyst comments:

The warning you experienced indicates that the application had not established reputation with the Microsoft Defender SmartScreen Application Reputation feature at that time.
We can confirm that the application %75656-rubenst-far cry 6 mobile.exe% (sha256 – “0C1D038F111E48B38D89E584C29F9BFBB87D72E58CDB97F08DB62EBE63442C37”) has since established reputation and attempting to download or run the application should no longer show any warnings.

Please note, however, that the submitted files are not signed using a valid digital certificate. Unsigned files will have to establish reputation each time a new version is released.

Application Reputation warnings are meant to indicate when applications do not have known positive reputation. This doesn’t mean that the application is malicious, only that it is “unknown.” Users can still proceed to download and run the application. If establishing reputation immediately is critical, you may want to consider investing in an EV Authenticode certificate. A valid EV Authenticode certificate can immediately establish reputation with SmartScreen reputation services even if no prior reputation exists. In order to be considered a valid EV certificate, the certificate must be issued by a Certificate Authority that is authorized by the Microsoft Trusted Root Certificate Program and recognized as an Extended Validation issuer.

Thank you for contacting Microsoft.
---------------------------------------------------

@CheatHappens: Perhaps investing (mostly a bit of time) in such an EV Authentication Certificate could help improve this situation as a whole and avoid confusion for other users. 😁

Did you white list the trainer and its location? As doing that will stop false positives being raised.

We have an EV certificate from GlobalSign that each trainer is signed with. You can view this signature yourself by right clicking on the trainer and clicking properties, then Digital Signatures. It doesn't get any more authentic than that. Only two of us even own the USB token required to sign the trainers. So, they are wrong on that part. But it won't matter soon when we release the All-in-One trainer app as it will be the same app for all users and will be signed as well. Right now, every stand-alone trainer is a little different so it's difficult for AV companies to whitelist all of them.

It became almost impossible to run those trainers....

I completly disabled the Windows Defender, and its still acting up like CRAZY lol
Its even deleting the Trainer File from the Zips 😫

[Edited by Knopperz, 10/20/2021 10:16:05 AM]

Very strange. The AIO will not have such issues.

WD completeltly off does zip at all. Sound like there is something else in play.

Most likely a browser security addon or the safe browsing feature, just turn it off for what every you are using and make you trainer folder excluded from all scans.

Glad to see its not just me....