fman 1.4.4 and Windows Defender

Written by Michael

Update

Microsoft have fixed the erroneous detection. If you still encounter problems, please follow these steps to clear the cache and obtain the latest malware definitions:

Open a command prompt as Administrator and navigate to c:\Program Files\Windows Defender.
Run MpCmdRun.exe -removedefinitions -dynamicsignatures.

Alternatively, the latest definitions are available for download here.

Unfortunately, Windows Defender thinks fman 1.4.4, which came out two days ago, is malware. Specifically, it claims fman is infected by Trojan:Win32/Tiggre!plock. The same happens for Microsoft Security Essentials on earlier versions of Windows.

Of course, fman is not a virus. I have given ample justification for this in an earlier blog post. The short summary is that fman is not an elaborate scheme to get malware onto your computer. It's a mission to create the world's best file manager.

Just to be safe I'm not inadvertently spreading viruses, I updated Microsoft Security Essentials to the latest version and ran a full check of my system. The only thing it "found" was fman itself:

I've submitted fman as a false positive to Microsoft. Hopefully, they will be able to simply update their virus definitions. In the meantime, to get fman working again, you will have to tell Windows Defender (/MS Security Essentials) that it's not a threat.

As for the "cause" of the problem, it seems to be that fman now uses a newer version of PyInstaller, the library that turns fman's source code into a standalone executable. Other developers are having the same problem. (For future reference: fman's PyInstaller version was updated from 3.3 to 3.4.)

I'm sorry if this affects you. It's very frustrating for me as well.