Would Personal Builds run win-11?

[a1call]

FTR my Antivirus software just reported that it blocked a suspicious activity by WhyNotWin11.

Can a Mod please remove the links and references in post-1.

If you have run the software already please note the warning.

Apologies for the posting. I thought it would be safe based on the cnet article.

[Uncwilly]

I broke the links. Anyone who wants to investigate it will have to do some assembly work.

[a1call]

Acknowledged with thanks.
FTR I did not have any warnings the 1st time I ran it when I initially posted.
Only when I ran it today.

[henryzz]

It wouldn't surprise me if it is an oversensitive AV complaining because it is doing fairly invasive checks.

[a1call]

Well, the thing is I did not have a warning the 1st time I ran the program (Or at least I can't remember to).
There are not any other complaints indexed by google anywhere so far.
The attachment is a screenshot from my AV.

[a1call]

I googled:
whynotwin11 malware

The site www. joesandbox. com reports it as Malicious:

System Summary:
barindex
Binary is likely a compiled AutoIt script file
Show sources
Malware Analysis System Evasion:
barindex
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Show sources
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Show sources
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Show sources
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Show sources
Query firmware table information (likely to detect VMs)

Here is a closed GitHub discussion regarding false ownership:

https://github.com/rcmaehl/WhyNotWin11/issues/66

a reddit discussion:

This website is not affiliated with the creator of the program. Although it uses a good download link at the time of this writing, I don't suggest anybody link others to this website, as they can change the link to a malicious one at any time.




UPDATE: They have switched the download link. Absolutely do not use.

https://www.reddit.com/r/Windows11/c...hynotwin11com/


From Norton "File-Insight":

Filename: WhyNotWin11.exe

____________________________

____________________________


Developers
Not Available

Version
2.3.0.3

Identified
2021-07-02 at 6:10:19 PM

Last Used
2021-07-30 at 3:31:50 PM

Startup Item
No


____________________________


Many Users
Thousands of users in the Norton Community have used this file.

Mature
This file was released 30 days ago.

Bad
There are many indications that this file is untrustworthy.

Another closed discussion from github:
Multiple Vendors False Positives #49
https://github.com/rcmaehl/WhyNotWin11/issues/49

[henryzz]

That list is things we would expect it to do.

[S485122]

Originally Posted by henryzz

That list is things we would expect it to do.

Indeed.
Most antivirus software do not like administrative tools (which they often categorise as hack tools.) Just try to retrieve the serial numbers of the installed software : most of the tools will be blocked by the "antivirus" software.

Jacob