Antivirus

Antivirus / Windows Defender Warnings

CGFS injects a DLL into FIFA 16's process to render its in-game overlay, and directly reads/writes FIFA's process memory to apply live match data — the Custom Substitutions feature additionally patches a small piece of executable code inside fifa16.exe to lift its 3-substitution limit. These are exactly the kind of API calls (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, remote code patching) that Windows Defender's behavioral/ML detection flags as process injection / defense evasion, even though nothing here touches any other process, reads personal data, or persists once FIFA closes. A detection named something like Behavior:Win32/DefenseEvasion.A!ml is this false positive, not a sign the download is compromised.

Before running Server16Python.exe for the first time, add an exclusion for it (and its folder) in Windows Security → Virus & threat protection → Manage settings → Add or remove exclusions. Adding the exclusion after Defender has already acted on a detection may not be enough — Defender's remediation can also affect the FIFA process it was attached to at the time (shown as a second process: entry in the detection details), which can leave FIFA unable to start ("Could not finish loading FIFA data") even once CGFS itself is trusted again. If that happens:

1. Check Windows Security → Protection History for every entry tied to that detection, not just the one for Server16Python.exe — something under your FIFA install may have been quarantined or reverted too.
2. Verify/repair your FIFA 16 game files through your launcher (Steam/Origin/EA App) to restore anything Defender touched.
3. Add the exclusion for both the CGFS folder and the FIFA 16 install folder, then relaunch.