Already submitted a SmartScreen false positive — still warned. What's the real process?

Thanks Rob, appreciate you digging that up.

The part I hadn't seen stated clearly anywhere is that there's no manual review

path for consumer SmartScreen. I'd been sending the file through the Defender

submission portal a few times, assuming that's how you request a re-check — so

that explains why nothing changed on my end. Good to finally know it's purely

organic.

The Store isn't really an option for me on this one, I want to keep it a plain

direct download from my own site. So from what you're saying it's basically:

keep the same signed file up, don't touch it, and let reputation build from a

wider spread of installs over the next few weeks.

One thing I'm still not sure about — early on I swapped the installer a couple

of times (rebuilds and re-signs), so the file hash kept changing. Am I right

that each of those basically reset the file-hash reputation to zero, and only

the certificate reputation carries across versions? Just want to make sure I'm

not shooting myself in the foot again.

Thanks again for the help.

Thanks Rob, that document cleared up the main thing for me.

The part I hadn't seen stated anywhere is that there's no manual review path for

consumer SmartScreen. I'd been sending the file through the Defender submission

portal a few times assuming that's how you request a re-check, so that explains

why nothing happened on my side. Good to know it's purely organic.

Here's what's puzzling me though: the installer is already at around 5,000

downloads/installs by now, it's signed with a valid Azure Trusted Signing cert

(verified publisher name shows correctly), and there are no detections. But

SmartScreen still throws the "unrecognized app" warning on download. Going by

the doc I'd have expected it to clear by now.

The Store isn't an option for me, I want to keep it a direct download from my own

site. So I'm trying to figure out what's actually holding it back.

One thing I suspect: early on I rebuilt and re-signed the installer a couple of

times, so the file hash changed more than once. Am I right that each change reset

the file-hash reputation to zero, and only the certificate reputation carries

over? If so, is the fix just to freeze one exact signed file and leave it

untouched until it builds up, or is 5,000 simply not enough of a "wide audience"
yet?

Thanks again for taking the time.

Again Nickola, I have no personal experience with this since my development years were during the period when assembly language applications for 8-bit processors like the Intel 8080 or Zilog Z-80 were still common.

However, since I spent many years in those previous Microsoft Answers and earlier forums helping with Microsoft security products, including when SmartScreen Filter first added its reputation abilities, I've seen much of the evolution of these and learned something about how they worked, in some cases from postings by internal Microsoft developers or other employees at the time.

The problem answering your questions is that things like the exact number of downloads have never been clear, likely because that may change if even a small number of users happen to select the 'not safe' option or something else that tends to count against this statistic. So, though I'd heard at the time that even a smaller number of downloads around 3,000 should be enough, it's both possible this might be negatively affected as I describe or simply that the numbers have changed over time, though that seems like plenty of downloads to me personally.

I do believe you may be onto something regarding the changed hash, though the way I read that is that once at least one distribution receives a good reputation, future revisions containing the same certificate should carry that reputation as well as long as there's no specific detection of malware within an app relating to that same certificate which as I understand it, destroys that certificate's reputation entirely (assuming the malware wasn't added later which should be detected by the fact the signature is corrupted).

This about describes the limits of my own interpretation and understanding of reputation's operation, though that document I found updated it to some extent.

You might try finding either Microsoft or possibly 3rd-party software development sites for Windows devices to learn whether anyone on one these has more direct experience, since these same sorts of issues pop up on occasion and I'm unfortunately limited in my knowledge, while I assume that most internal Microsoft developers don't any longer frequent forums such as these. Especially not the AI developers.

Rob