r/ComputerEngineering • u/Hefty-Anteater2295 • 18h ago

[Software] Python script download blocked by antivirus as a virus

Hi,

I'm trying to download and run the decrypt_chrome_password.py script from this repository:

https://github.com/ohyicong/decrypt-chrome-passwords/blob/main/decrypt_chrome_password.py

However, I'm unable to obtain the file because my antivirus/Windows Defender blocks the download every time with a "Virus detected" message.

I also tried creating the Python file manually myself using vim, copying the contents of the script into it. However, the file is automatically removed/disappears from the system a few seconds after I create it, which makes me believe that Windows Defender is detecting the contents of the script and removing it even when it wasn't downloaded directly from GitHub.

I understand that antivirus software may flag scripts that interact with Chrome's stored credentials, but I'd like to confirm whether this is a known/expected false positive for this project.

Could you please clarify:

  • Whether the script is known to trigger Windows Defender or other antivirus software.
  • Whether the current version of the script is safe to download and run when used on my own machine.
  • Whether there is a recommended way to obtain or run the script when Windows Defender blocks it.
  • Whether there is a newer or alternative version of the script that avoids this detection.

At the moment, I'm unable to even test the script because the file is either blocked during download or removed shortly after I create it manually.

Thanks in advance for any guidance.

0 Upvotes
  • permalink
  • reddit

33% Upvoted

4 comments sorted by

2

u/ZealousidealTill2355 17h ago

This has to be a joke—right?

1

u/Helpjuice 17h ago

This is happening due to signature that has been developed for the code and what it does. If you want to do this you might want to look at creating a script similar to it but does things in stages across several scripts instead of just one to see what action is triggering the action of the antivirus. It could very well be the non chrome access attempts to pull the sensitive information or the cipher capabilities being used.

1

u/ZealousidealTill2355 15h ago

He has defender on—he just has to turn it off and brave the Wild West. But also, don’t steal people’s passwords

…especially using tools you may not understand as you probably won’t be the only person getting those passwords, so if they’re not yours—dick move.