[BUG] Virus detected

[h4aLkon]

Latest version 5.2.1 gets flagged by Microsoft Defender Trojan:Script/Sabsik.FL.A!ml (threat blocked, status: removed) while downloading it from Github.

[justnullname]

Hi @h4aLkon, thanks for bringing this to my attention!

Please rest assured that this is a False Positive.

The !ml suffix in the threat name (Trojan:Script/Sabsik.FL.A!ml) indicates that this was flagged by Windows Defender's Machine Learning heuristic algorithm, not by an actual virus signature. Because QuickView is a native C++ application that lacks an expensive Code Signing Certificate, and it contains normal behaviors like registering file associations, strict AI engines sometimes aggressively flag it as suspicious.

To ensure your safety, I have scanned the files on VirusTotal:

The downloaded .zip release is 100% clean (0 detections).

The extracted QuickView.exe has a 1/72 detection rate (only flagged by one overly strict heuristic engine called SecureAge, while the other 71 top vendors confirm it is clean).
You can check the report here: (https://www.virustotal.com/gui/file/5176dce1eb7acc2d0557e7bea762a26d0095b758a60463d1bf26f31839b73686/detection)

Actions taken:
I have submitted this version to Microsoft Security Intelligence as an incorrect detection. They usually review and clear these false positives within a few days in their definition updates.

In the meantime, it is completely safe to bypass the warning to install. Thanks again for your support and feedback!

[justnullname]

Analysis of the possible reasons for the false positive:
Quickview currently uses a .bat script to download update packages from GitHub, extract them, and replace the old files. This behavior might resemble how some malware operates, which can trigger a false alarm. Additionally, Quickview automatically registers itself to the right-click context menu, involving registry modifications and additions. This action is also frequently flagged as a potential threat by heuristic engines.

The safest approach to updating would be to introduce a new, dedicated updater tool. However, this would ruin Quickview's core feature of being a clean, portable, single-.exe application. I will try to figure out a better workaround.

Thank you for bringing this up and for your attention!

[justnullname]