Docs/Get started

Antivirus and SmartScreen

New programs often get a warning from Windows SmartScreen, and now and then an antivirus flags a tuning tool. This page explains why, how to check that your copy is genuine, and how to allow it.

Why warnings happen#

• No reputation yet. SmartScreen and many antivirus products trust files that millions of people have already run. A new app starts at zero, and its reputation grows with every download.
• Frametide does what malware also does, for a good reason. It asks for administrator rights, changes registry values, power plans and services, starts PowerShell and Windows tools such as powercfg, and records frame times through Windows' event tracing. Behaviour-based scanners (“heuristics”) see the pattern without knowing the purpose. Such detections usually have generic names like Wacatac, Gen:Variant, Heur, ML or Suspicious.
• The installer unpacks itself. Self-extracting installers are a classic hiding place for malware, so some scanners look at them more closely.

What Frametide does not do: inject into games or other programs, install drivers or services, run in the background when closed, or collect personal files. What it sends over the internet is listed in the privacy policy.

“Windows protected your PC” (SmartScreen)#

1. Click More info (a small link in the message).
2. Check the file name Frametide-win-Setup.exe.
3. Click Run anyway.

Microsoft Edge can also hold back the download (“…isn't commonly downloaded”): open the downloads list, click … next to the file → Keep → Show more → Keep anyway.

Make sure your copy is genuine#

• Only download from frametide.de/download. It leads to Frametide's official release page, github.com/myklewz/frametide-releases.
• Upload the installer to virustotal.com. It checks the file with about 70 antivirus engines. One or two generic detections with names like the ones above are typical false positives for a new tuning tool; dozens of detections, or names of known malware families, are not. In that case, don't run it and write to support.

Your antivirus blocked or deleted Frametide#

1. Restore the file from quarantine. Every antivirus has a quarantine (sometimes called vault or chest) with a Restore button.
2. Add an exclusion for the program folder, so the next update isn't blocked again:
   %LOCALAPPDATA%\Frametide
   (on most PCs that's C:\Users\<your name>\AppData\Local\Frametide).
3. If the installer itself was removed, download it again and add the exclusion before running it, or restore it from quarantine.
4. If the app reports errors after a block, run the installer again: it repairs the program and keeps your data.

Microsoft Defender (Windows Security)

1. Start menu → Windows Security → Virus & threat protection.
2. To restore: Protection history → the Frametide entry → Actions → Restore (or Allow on device).
3. To exclude: under Virus & threat protection settings click Manage settings → Exclusions → Add or remove exclusions → Add an exclusion → Folder → choose %LOCALAPPDATA%\Frametide.

Other antivirus programs

Menu names change between versions, but the place is always similar: look in the settings for Exceptions, Exclusions or Allowed apps, and add the folder above.

Report the false positive#

Every report makes the warning go away sooner for everyone. Antivirus vendors have a form for false positives (search for the product name plus “false positive”); Microsoft's is at microsoft.com/wdsi/filesubmission. Choose “incorrectly detected” and upload the flagged file. A short mail to support@frametide.de with the antivirus name and the detection name helps us report it too.

With a third-party antivirus, some Defender settings say “not active”#

When another antivirus is installed (for example Panda Dome, Avast or Norton), Windows turns Microsoft Defender's scanner off. Frametide's Defender settings, such as low-priority scheduled scans, then show a message like “Microsoft Defender is not active on this PC (another antivirus replaces it)”. That's expected and not an error: those settings simply don't apply, and the other settings work as usual.