windows protected your PC

[doubletaro]

I can't executed labelme.exe at below Link.

[https://github.com/wkentaro/labelme/releases/download/v5.0.1/Labelme.exe](url)

When I run the exe I get this message.

[https://upload.wikimedia.org/wikipedia/commons/thumb/3/3e/Windows_protected_your_pc.png/636px-Windows_protected_your_pc.png](url)

Why am I getting this message?
Is this safe?

[BL1NDX3N0N]

This would be Windows SmartScreen blocking software not digitally signed from executing. Please note that just because an executable is not digitally signed does not determine whether it is malicious or not, most people do not sign their programs simply because it is too much money especially for FOSS. However, Microsoft will still block as much of it as they can as a precaution to keep users safe. If you have determined the program is not malicious or want to proceed with execution at your own discretion then click the "More info" link-label, afterwards a "run anyways" button will appear and your decision will be saved for that program for future uses.

[doubletaro]

Thank you for the explanation.

What are some ways to determine that a program is not malicious?

[BL1NDX3N0N]

There are a couple of ways. First and foremost, thousands of man-years have been spent developing anti-virus software and analyzing software by teams such as Microsoft Security Intelligence. Use the platforms native anti-virus solution and ensure you have the latest definition updates. Anti-virus software however isn't a magic bullet, there are going to be false positives or simply negatives as threat actors will try their best to evade detection. It will always be a game of cat and mouse. If the anti-virus doesn't throw a positive then the next step would be verifying the software is genuine. This can be done by comparing hashes of the installer or assembly files, the developers would provide you with the correct hashes. If the hashes do not match then files were either corrupted, tampered with, or they are simply fake. Next would be verifying the software is digitally signed and verifying the entity that was issued the certificate is the author of said software. I say this because digital certificates can indeed be stolen and applied to malware to evade detection and prevent Windows from blocking execution. If the software is not digitally signed then this is where user awareness comes into play. The first thing you should do before running anything not digitally signed and that you didn't compile yourself with source access is to search online religiously for reviews. Fake reviewing bot nets do exist so do not rely on thousands of good reviews. The only reviews you need to look out for are the negative ones. If people had a problem with the software they are going to mention it and or warn users. You see any reviews such as those then you need to determine whether their issue was related to system incompatibilities or if damage was intentionally done. If a couple reviews like these add up to each other then delete the software, even if it does not sound like it was malicious do not take the risk as data on your system should be protected at all costs. Let's say all the reviews check out but you are still iffy, either run the software in a sandbox or VM. If running on a VM then process monitoring software can be used to get a high-level glimpse of what it is doing. Touching the registry, IO operations, networking, etc, will be exposed. However, do not rely on this alone. It is very easy to write code which can detect whether it is being executed on a virtual environment and will only execute its payload when ran on the host operating system. Afterwards, if you still feel iffy, the only surefire way to determine whether the software is malware is to decompile it. This isn't for everyone and should only ever be used as a last resort and by those who know what they are doing. Some assembly files are easier than others to decompile, mainly managed assemblies developed with .NET or Java, as converting the bytecode back to the original source is trivial. For assemblies that are unmanaged, this is where things become extremely difficult due to CPU differences. Software such as Ghidra will help but only so much. Once again, last resort and you must know what you are doing.

The best thing you can do for yourself is trust your gut and have user awareness. Do not download software from any websites that are both not from the original developers and that do not have an SSL. The reason you look for an SSL is because you can verify the site belongs to the entity they claim themselves to be and a lot of malware developers like to cheap out on these sorts of things or rely on free services that offer it. Furthermore, perform a WHOIS lookup on the domain to see if it was registered by the actual entity. Verify everything that you can and if deciding to run the software do not grant it administrative privileges until you have determined why they are needed. User awareness isn't always going to save you however, some people are masters at social engineering, zero-days exist, UAC bypasses exist, and so on. Because of this, always create an offline backup of your system on a backup drive. Never keep said drive plugged in either, only mount the drive after you have both verified the system is not compromised and wish to perform a backup. Afterwards, lock the drive in a secure location.

I know this is a lot of information to be dumped on you but this is the reality of our situation. Take and apply what you will and good luck.

[doubletaro]

It's certainly a very difficult problem for me.
What I can do is
Scan with virus detection software and google for majority opinion.
Ultimately, I would rely on my intuition.

Your message was very helpful.
Thank you very much.

[BL1NDX3N0N]

Of course, it is what we are here for. If your question has been answered though then please consider marking the thread as solved.

[doubletaro]

sure!
How do I solved this GitHub discussion thread?

[BL1NDX3N0N]

That I cannot provide an answer for unfortunately as I have never opened a discussion before. You should be able to click the three dots on the comment that answered your question and see if there is an option to select it as an answer or you will have to look through the options in the sidebar of this discussion.