Windows Defender flagging SpotX installation as HackTool:Win32/Crack!MTB

[Kaltsit-sudo]

Hi everyone,

I just ran into an issue where Windows Defender on Windows 11 completely flagged and quarantined the files right after installation. It's flagging it as a potential risk, specifically hitting Spotify.exe, the shortcuts, and the registry keys.

Here are the specific details from the Windows Security log (with my local username/SID anonymized):

Detection: HackTool:Win32/Crack!MTB

Alert Level: High / Hoog

Status: Quarantined

OS: Windows 11

Affected items listed by Defender:

C:\Users\[YourUsername]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk

C:\Users\[YourUsername]\AppData\Roaming\Spotify\Spotify.exe

C:\Users\[YourUsername]\Desktop\Spotify.lnk

Registry Key: HKCU@S-1-5-21-[ANONYMIZED_SID]\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Spotify

I assume this is a false positive due to how the script modifies the client, but I wanted to report it here so the team is aware of the exact signature Windows Defender is throwing right now.

Is there a recommended workaround for this specific definition update, or should I just manually whitelist the paths? Thanks!

[Dark-Ungel]

I got this same flag just now

[CrazyEmerald]

Hope this gets resolved, I am NOT going back to ads

[FlorkyKit]

Just got this too, never had this problem installing it a few months ago on a different device

[CrazyEmerald]

I had it for about a month or 2, even tried retrying and windows deleted it all 3 times

[Volfield]

Just got this too

[soupmix999]

anyone with more coding experience, can they explain what this is exactly? just wanna triple check i'm all good

[batersky]

I also just got this but it was upon startup instead of installation. It also flagged my pinned taskbar shortcut? Im like 99% this is fine, Ive had SpotX for years by now, but since this never happened before and it seems to be happening to multiple people I wanna be 100.

[mavimoros]

same

windows uninstalled my spotify, and when I tried to go back I found that it is blocking it

[bhavyapandya07]

Just got the same flag for me as well, even reinstallation doesnt work, so Ig need a new fix/patch for this issues asap

[davidmateo668]

As today, is still giving the same flag. Hope it gets fixed soon.

[Kaltsit-sudo]

Thanks; it saves me time from trying. If it doesn't work by Monday, I will probably tell my AV to ignore it.

[storm64007-tech]

Getting this as well on Win11.

[amd64fox]

I added logic to the main script that automatically adds exclusions to Microsoft Defender, for other av you need to do this manually,

If you run the script with administrator privileges, this will happen automatically, otherwise, confirmation will be required

if you don't need to add exclusions to Microsoft Defender, then use the defender_exclusions_off parameter to disable this

this is all i can do at the moment

[Kaltsit-sudo]

Thanks, chap; it works like a charm. I knew it was Windows fuckery.

[bhavyapandya07]

This works 100%

just download the whole code from main repo, then extract it in some folder and then download this guys file run.ps1 and replaced it into the main folder done

[rxlxtxvxst]

How did you guys add the exclusions? Can you please share steps? Thanks!

[amd64fox]

@rxlxtxvxst

run the script again with the -Verbose parameter

and show the terminal output

[ritef-sudoi]

It worked perfectly.

Thank you for creating all of this

This makes my days better.