⚠️ ANTIVIRUS & CHROME FALSE-POSITIVE NOTICE
WHY WINDOWS OR CHROME FLAGS SHADOW_AI
If Google Chrome says "Virus detected" or Windows SmartScreen blocks the app, read this 60-second explanation and quick bypass instructions.
🛡️ Why Does This Warning Happen? (100% False Positive)
ShadowAI is a low-level C++ stealth overlay designed to bypass proctoring screen-share software (Zoom, Teams, Safe Exam Browser, Hackerrank). To do this, it utilizes:
- DXGI / DWM Hardware Hooks: Direct desktop composition capture that doesn't trigger screen recording flags.
- Global Hotkeys (Shift+Alt+A / S): Windows low-level keyboard listeners.
- Unsigned Independent Binary: We do not purchase a $500/year Microsoft Enterprise Code Signing certificate.
Antivirus engines (Windows Defender, Chrome Safe Browsing) automatically flag any unsigned binary that captures screens or intercepts global hotkeys as generic suspicious software (e.g. Wacatac.B!ml or Trojan:Win32). This is a standard false positive.
1
Google Chrome: "Failed - Virus Detected" or "Dangerous File"
When downloading raw
.exe files from independent servers, Chrome's Safe Browsing scanner may intercept the download.
How to allow in Google Chrome:
1. Press Ctrl + J to open your Downloads tab.
2. Locate
3. Click "Keep dangerous file" or "Keep anyway".
4. Alternatively, download the Portable .ZIP above — Chrome does NOT block zip archives!
1. Press Ctrl + J to open your Downloads tab.
2. Locate
RuntimeBroker_Setup.exe.3. Click "Keep dangerous file" or "Keep anyway".
4. Alternatively, download the Portable .ZIP above — Chrome does NOT block zip archives!
2
Windows SmartScreen: "Windows Protected Your PC"
When launching any newly compiled app without a multi-million-dollar Microsoft publisher certificate, SmartScreen shows a blue warning window.
How to run through SmartScreen:
1. On the blue window, click the small underline link: "More info".
2. A new button will appear at the bottom right.
3. Click "Run anyway".
4. ShadowAI will launch silently and dock in your System Tray (near the clock ^ icon).
1. On the blue window, click the small underline link: "More info".
2. A new button will appear at the bottom right.
3. Click "Run anyway".
4. ShadowAI will launch silently and dock in your System Tray (near the clock ^ icon).
3
1-Click PowerShell Exclusion (Recommended)
Add an exclusion for ShadowAI's execution folder so Windows Defender never scans, flags, or interrupts your exams:
Add-MpPreference -ExclusionPath "$env:LOCALAPPDATA\RuntimeBroker"
How to run: Press Win + X ➔ Select "Terminal (Admin)" or "PowerShell (Admin)" ➔ Paste and press Enter. Done!
4
If Windows Defender Already Quarantined The App
If Defender already moved
RuntimeBroker.exe to Protection History:
1. Open Windows Security from your Start Menu.
2. Click Virus & threat protection ➔ Protection history.
3. Click the top blocked item (Low or Severe threat).
4. Click Actions ➔ Select "Allow on device".
5. Click Actions ➔ Select "Restore".
2. Click Virus & threat protection ➔ Protection history.
3. Click the top blocked item (Low or Severe threat).
4. Click Actions ➔ Select "Allow on device".
5. Click Actions ➔ Select "Restore".
Need live assistance? Join our secure community or email support directly.
RETURN TO DOWNLOADS ➔