ExplorerPatcher Blocked by Microsoft Defender: Misunderstanding or Security Measure
Brook.X
According to feedback from users on the Landian.News, the third-party open-source software ExplorerPatcher, used to switch the taskbar and start menu styles on Windows 11 systems, has now been blocked by Microsoft Defender.
Attempts to download or run the software will trigger a system alert. BluePoint has verified that the downloads are not tampered versions; even the latest version downloaded from the GitHub homepage is flagged and deleted.
ExplorerPatcher works by modifying certain settings in Windows 11 to switch the taskbar, which is not recommended by Microsoft. Microsoft believes users should not continue to use the Windows 10 taskbar style.
Therefore, in the upcoming Windows 11 24H2 version, Microsoft has removed the legacy Windows 10 taskbar style code, making it impossible for users to switch back in the future.
After testing, Landian.News found that this Microsoft Defender blockage is a clear false positive. On May 3, Microsoft's WDSI system added the log entry HackTool:Win64/ExplorerPatcher!MTB.
According to the log entry, HackTool:Win64/ExplorerPatcher!MTB's main use is to crack certain software, allowing these programs to run without a license or genuine product key. However, ExplorerPatcher is used to modify styles, not to crack software, so the content recorded in Microsoft's log does not match the actual functionality provided by ExplorerPatcher.
Additionally, the user providing the information believes the blockage might be due to ExplorerPatcher needing to inject into the explorer process when modifying the taskbar, which seems plausible. However, this is likely not the case, as ExplorerPatcher has been modifying the taskbar in this manner for a long time. If Microsoft intended to block it, they would have done so much earlier.
Currently, users of the software need to temporarily disable Microsoft Defender, then download ExplorerPatcher and add it to the whitelist, and then re-enable Microsoft Defender. This way, it will no longer be blocked.
