Bug: 2.2.0 Detected as malware by defender (again)

[Msprg]

Opening a new issue as per #235

[amadeo-alex]

Hello, was this an upgrade from previous version or direct 2.2.0 install on system where HASS.Agent was never installed previously?

[Msprg]

If I recall correctly, it was upgraded, but not recently. Likely sometime in January / February when the 2.2.0 release was made. Nothing significant has happened since then until now when defender suddenly decided to mark the file as malware and quarantine it. ... Well I did run manual Windows update check a few days before windows defender detected it, but I'm not sure whether I would correlate that.

[amadeo-alex]

From 2.2.0 HASS.Agent does not ship LHM (along with WinRing0 which creates those files) and includes a few places where it attempts to remove the file if it exists.
The issue is if antivirus has ever caught wind of those files (of course starting with the date WinRing0 was marked as a problem) installer is not able to remove it.

Can you please check the creation and modification of the file? That unless you've told AV to remove it.

[Msprg]

Hmm... the file properties say:

Created 19.05.2026
Modified 28.05.2026&

However, the windows defender has already attempted to remove it by itself so it might be because of that. Either way, should I uninstall the satellite service completely as an attempt to get to a "clean" state or reinstall the latest version or what is the best course of action for me? I would just like to keep my connection configuration preserved.

[amadeo-alex]

There is one more thing that just came to my mind (failure of installer to upgrade the satellite service) but that would be some rare edge case.
Let's do two things:
One:

• could you please screenshot me details/version after clicking on the satellite exe file and then properties? (is it in the program files directory where it was installed)
• could you please screenshot me the version from Satellite configuration window (opened from HASS.Agent)

Two:

• please close HASS.Agent and stop the Satellite Service in WIndows Services
• tell defender/AV to remove the offending file