Microsoft Defender thinks Paint.net is suspicious

[Slamb]

Once or twice a day, the launch of Paint.net takes forever, maybe half a minute or even more. I found this topic and adding Paint.Net folder to Defender exclusions seems to fixed the problem. But why Defender thinks theres something suspicious in Paint.Net? 🤔 I dont use any plugins, any modifications, only clean portable app without any tweaks. I tried deleting whole app, whole settings in AppData, but with no effect. There wasnt such problem with 4.3 🤔

[BoltBait]

1 hour ago, Slamb said:

Defender thinks theres something suspicious in Paint.Net?

Sounds like a Defender problem. 
 

1 hour ago, Slamb said:

adding Paint.Net folder to Defender exclusions seems to fixed the problem.

And, you answered your own question. 

[Slamb]

I just wanted to be sure if something wrong didn't happen to new Paint 🙂 Started a topic on Microsoft forum 👍

[Rick Brewster]

Could be related to this. If I can find a way to sign all of the DLLs without extending my build time by a crazy amount (it adds 30 minutes), that might help.

 

 

 

[Slamb]

i dont know how all these things work, but i understood you need some free timestamp server that does not have rate limiting 🤔 i tried to find some and found this https://freetsa.org/, it has many options and apis, but i didnt manage to find some info about rate limiting 😔 also found some fresh TSA list https://gist.github.com/Manouchehri/fd754e402d98430243455713efada710?permalink_comment_id=3810141#gistcomment-3810141, maybe you can find something suitable there 🤔

[Rick Brewster]

Another thing is that Defender and other AVs will often "learn" over a week or two that a new release/update for Paint.NET is fine/legit, and will stop doing the in-depth security scans on it.

 

I've also seen them "forget" for older builds -- like if you try to run 4.2.16 today, it'll likely do a in-depth scan on it.

 

Adding your plugins folders to your AV's exclusion list is a good idea. The files get scanned anyway when you download them. It's not a perfect solution, from a security standpoint, but it's a reasonable balance.

[Slamb]

the problem is fixed 😊 instead of portable zip i downloaded install zip, extracted the exe and this version doesnt have problem with defender 😮 im testing it for one day already and no stuck at all

currently i use the content only from paint.net.5.0.install.x64\x64 folder, but there was also some PaintDotNet_x64.msi inside 🤔

 

Edited January 14, 2023 by Slamb