Windows Defender

Is this malware?

No. Program:Win32/Wacapew.A!ml on Sidecar.dll is a heuristic false positive, not confirmed malware.

The !ml suffix means Defender used machine learning, not a known virus signature. Unsigned game-hook DLLs are flagged until they are Authenticode-signed or Microsoft clears the detection.

We do not recommend weakening Windows Defender (folder exclusions, disabling real-time protection, etc.). The durable fix is signed releases from this project.

What to do if Defender blocks install (unsigned build)

1. Download only from GitHub Releases.
2. Compare the ZIP's SHA-256 with the .sha256 file published beside it, then run preflight.cmd, which checks every extracted file against MANIFEST.txt.
3. If you believe the detection is wrong, report it to Microsoft at file submission (Incorrectly detected as malware → Program:Win32/Wacapew.A!ml).
4. Wait for a signed release (see docs/development/CODE_SIGNING.md): that is what we ship as the permanent fix.

If Defender offers Allow on device for a file you downloaded from our official release page and verified by hash, that is your local decision. The troubleshooting guide lists the commands to check what Defender did and, if you choose to, exclude the verified folder.

Permanent fix (signed builds)

Unsigned builds may trigger Wacapew.A!ml on some PCs. Authenticode signing is the reliable fix:

• SignPath Foundation (free for OSS): see docs/development/CODE_SIGNING.md
• Or Azure Artifact Signing in GitHub Actions

Signed releases show a verified publisher and build SmartScreen/Defender trust over time.

Why Defender flags this project

Behavior	Why we do it	Why AV cares
Sidecar.dll injected into USF4	Rollback netplay (GGPO)	Same pattern as cheats/trainers
Microsoft Detours	Official hook library	Process modification
Networking	Online play	Extra scrutiny
No signature (yet)	Indie OSS	Low reputation score

The injection code in src/sidecar/sidecar.cxx has kept the same hook mechanism since v0.3.1; later versions added netplay transport, PE version metadata and validation of the launcher's payload, not a different hook mechanism. Different release builds can have different Sidecar.dll SHA256 hashes from rebuilds and VERSIONINFO. That does not mean the hook behavior changed.

Source: github.com/Confetti3/SF4-Ember-Netplay

Verify files (recommended)

Get-FileHash Launcher.exe, Sidecar.dll, sf4-net.exe -Algorithm SHA256 | Format-Table

Compare with the matching lines in the package's MANIFEST.txt, or run preflight.cmd to check them all.

Maintainer checklist each release

1. Run scripts/prepare-defender-submission.ps1 and submit Launcher.exe, Sidecar.dll, and sf4-net.exe at Microsoft file submission (Incorrectly detected → Wacapew.A!ml).
2. Ship signed binaries when SignPath/Azure is configured (docs/development/CODE_SIGNING.md).
3. Publish the ZIP's .sha256 beside it.
4. Once signing is configured, promote a release to Latest only after Authenticode signatures validate.