How to troubleshoot antivirus software flagging ego(lite) for Windows as a virus

If you use ego(lite) on Windows, antivirus software such as Kaspersky may report ego.exe as a virus or a trojan, move it to quarantine, or stop it from opening.

ego.exe is the program file of ego(lite) on Windows. An alert like this is a false positive: the file is safe, but the antivirus has misjudged it.

This post shares our scan results, says what we are doing about it, and shows how to keep using ego(lite) while antivirus vendors update their detections.

ego(lite) virus scan results

We've run ego.exe through VirusTotal, which checks a file against more than 70 antivirus engines, and the results are clean.

ego(lite) is also code-signed, so it is not software from an unknown source: Windows and your antivirus can see who published it.

If your antivirus still flags ego.exe

Don't worry. Antivirus products use different detection methods, so one product can flag a file that others find clean.

We are working with the major Windows antivirus vendors to add ego.exe to their allowlists, so their products stop flagging it.

Each vendor updates its detection on its own schedule, and the fix reaches you through a normal definition update. Alerts may therefore stop at different times for different products.

Fix the false positive: add ego.exe to your trusted applications

Until your antivirus vendor updates its detection, you can tell your antivirus to trust ego.exe and keep using ego(lite). Only do this for a copy you downloaded from our download page or our repository on GitHub.

1. Restore ego.exe if it was quarantined

Skip this step if ego.exe is still in place. Otherwise, restore it from your antivirus's quarantine list. In Microsoft Defender:

1. Open Windows Security from the Start menu and select Virus & threat protection, then Protection history.
2. Select the ego.exe entry, then Actions > Restore.
3. Defender detects the restored file again and adds a new entry. Open it and choose Allow on device.

Reviewing protection history needs an administrator account. If the file was deleted or will not restore, add the exception in step 3 first, then reinstall ego(lite) from the download page.

2. Find ego.exe

Most antivirus products ask you to browse to the program file, so you need to know where it is:

• Right-click the ego(lite) shortcut on your desktop and select Open file location. File Explorer opens the folder that contains ego.exe.
• If ego(lite) is running, you can also open Task Manager, go to Details, right-click ego.exe, and select Open file location.

To copy the full path, right-click ego.exe and select Copy as path. On Windows 10, hold Shift while you right-click to see that option.

3. Add the exception

Microsoft Defender (Windows Security)

1. Open Windows Security and select Virus & threat protection.
2. Under Virus & threat protection settings, select Manage settings.
3. Under Exclusions, select Add or remove exclusions, then Add an exclusion > File.
4. Select ego.exe and confirm.

Microsoft's Add an exclusion to Windows Security has the same steps with screenshots.

Kaspersky

1. Open Kaspersky's settings and go to Threats and Exclusions. The exact labels vary slightly between versions.
2. Select Specify trusted applications, add ego.exe, keep the suggested rules, and save.
3. Kaspersky still scans the program file of a trusted application. If scans keep flagging ego.exe, also add it under Manage exclusions.

Kaspersky's Threats and Exclusions help page explains the difference between trusted applications and exclusions.

Other antivirus products

• Norton: Settings > Antivirus > Scans and Risks > Items to Exclude from Scans. See Norton's guide.
• Bitdefender: Protection > Antivirus > Settings > Manage exceptions. If Advanced Threat Defense blocks ego.exe, add it there too. See antivirus exceptions as well as Advanced Threat Defense exceptions.
• ESET: Advanced setup (F5) > Detection engine > Exclusions > Performance exclusions. See ESET KB2769.
• Avast, AVG, McAfee, and others: look for Exceptions, Exclusions, Excluded files, or Trusted applications in the settings, or search the vendor's help center for how to exclude a file.

Menu names change between versions, so if a label above does not match what you see, follow the vendor's current guide.

Keep in mind:

• Add ego.exe itself, not a whole drive or your user folder, and keep your antivirus turned on.
• If an alert names a different file inside the ego(lite) folder, add that file the same way and let us know which one it was.
• If alerts come back after an ego(lite) update, check that the exception still points to ego.exe. Some products tie exceptions to a file's hash, which changes with every build.
• Once your antivirus vendor has fixed the detection, you can remove the exception.

Contact us

If an alert keeps coming back or you have questions, email support@citrolabs.ai with:

• your antivirus product and its version
• the detection name, exactly as the alert shows it
• your ego(lite) version
• a screenshot of the alert, if you have one

These details let us report the detection to the right vendor. You can also ask in our Discord community. Step-by-step instructions are also in the Windows docs.