Windows SmartScreen Warnings and Antivirus False Positives

Run a Clash Verge Rev installer on Windows and there is a fair chance you will meet a blue SmartScreen banner — "Windows protected your PC" — or find that Windows Defender has quietly quarantined the mihomo core a few days later. For open-source proxy tools this is routine, and it is worth understanding why before deciding what to do about it.

This guide explains what triggers the warnings, how to get past SmartScreen deliberately rather than reflexively, how to recover a file Defender already removed, and how to add a narrow exclusion — all without switching off your protection.

Why proxy clients trip the alarms

Two reasons stack on top of each other. First, community projects rarely buy commercial code-signing certificates, so their binaries carry no reputation in Microsoft's eyes — and SmartScreen's whole model is reputation. An unsigned, recently released executable is "unknown", and unknown gets a warning regardless of content. Second, what a proxy client does — forwarding traffic, installing services, creating virtual network adapters for TUN mode — overlaps with behavior heuristics that antivirus engines watch for. The result is a steady stream of false positives against Clash-family tools.

Be precise about what this means: a warning is not evidence of malware, but it is not evidence of safety either. The conclusion "this is a false positive" is only justified when you obtained the file from a source you trust — which is the real security decision in this whole story.

Getting past SmartScreen

1. When the "Windows protected your PC" screen appears, click More info.
2. The publisher and filename appear, along with a Run anyway button — click it to proceed with the install.

That is the entire mechanism: you are overriding a reputation check, one file at a time. Do it only for installers you downloaded from this site's download center or the project's official GitHub releases — and never for a "client" that arrived through a chat group or an ad.

When Defender has already removed the file

If the app suddenly fails to start and the core binary is missing, check whether Defender quarantined it: open Windows Security → Virus & threat protection → Protection history, find the recent detection, expand it, and choose the action to restore (wording varies slightly across Windows builds). The file returns to its original location. Expect it to be re-detected on the next scan unless you also add an exclusion — restoring and excluding are two halves of one fix.

Adding a narrow exclusion

1. Open Windows Security → Virus & threat protection.
2. Under the settings section, choose Manage settings, then scroll to Exclusions.
3. Click Add or remove exclusions, then Add an exclusion → Folder.
4. Select the client's installation folder (and its data folder, if the core lives there).

How to verify what you are trusting

The honest answer to "is this file safe?" is a chain of checks, each cheap. The projects are open source, so the code is publicly auditable and builds are published by the maintainers. Compare what you downloaded against the official release: matching filename and version on the project's GitHub Releases page is the baseline; the checksums maintainers publish let you go further. Mirrors — including ours — should always agree with those official assets, and a mismatch is a reason to stop. Repacked installers on file-hosting sites are where real malware hides behind the "false positive" excuse, which is exactly why cultivating a few trusted sources beats evaluating each download from scratch — a theme explored further in the privacy and security tips.

After the warnings are handled

Once installed and excluded, the client behaves like any other app — warnings do not recur for the same files, though updates can restart the cycle since each new binary begins reputation-free. If the app installs cleanly but will not start or connect, that is no longer a Defender story: continue with the Windows install guide or the common errors reference.