How to troubleshoot antivirus software flagging ego(lite) for Windows as a virus

If you use ego(lite) on Windows, antivirus software such as Kaspersky may report ego.exe as a virus or a trojan, move it to quarantine, or stop it from opening.

ego.exe is the program file of ego(lite) on Windows. An alert like this is a false positive: the file is safe, but the antivirus has misjudged it.

This post shares our scan results, says what we are doing about it, and shows how to keep using ego(lite) while antivirus vendors update their detections.

ego(lite) virus scan results

We've run ego.exe through VirusTotal, which checks a file against more than 70 antivirus engines, and the results are clean.

ego(lite) is also code-signed, so it is not software from an unknown source: Windows and your antivirus can see who published it.

If your antivirus still flags ego.exe

Don't worry. Antivirus products use different detection methods, so one product can flag a file that others find clean.

We are working with the major Windows antivirus vendors to add ego.exe to their allowlists, so their products stop flagging it.

Each vendor updates its detection on its own schedule, and the fix reaches you through a normal definition update. Alerts may therefore stop at different times for different products.

Fix the false positive: add ego.exe to your trusted applications

Until your antivirus vendor updates its detection, you can tell your antivirus to trust ego.exe and keep using ego(lite). Only do this for a copy you downloaded from our download page or our repository on GitHub.

1. Restore ego.exe if it was quarantined

Skip this step if ego.exe is still in place. Otherwise, restore it from your antivirus's quarantine list. In Microsoft Defender:

1. Open Windows Security from the Start menu and select Virus & threat protection, then Protection history.
2. Select the ego.exe entry, then Actions > Restore.
3. Defender detects the restored file again and adds a new entry. Open it and choose Allow on device.

Reviewing protection history needs an administrator account. If the file was deleted or will not restore, add the exception in step 3 first, then reinstall ego(lite) from the download page.

2. Find ego.exe

Most antivirus products ask you to browse to the program file, so you need to know where it is:

• Right-click the ego(lite) shortcut on your desktop and select Open file location. File Explorer opens the folder that contains ego.exe.
• If ego(lite) is running, you can also open Task Manager, go to Details, right-click ego.exe, and select Open file location.

To copy the full path, right-click ego.exe and select Copy as path. On Windows 10, hold Shift while you right-click to see that option.

3. Add the exception

Microsoft Defender (Windows Security)

1. Open Windows Security and select Virus & threat protection.
2. Under Virus & threat protection settings, select Manage settings.
3. Under Exclusions, select Add or remove exclusions, then Add an exclusion > File.
4. Select ego.exe and confirm.

Microsoft's Add an exclusion to Windows Security has the same steps with screenshots.

Kaspersky

These screenshots show how to add a file scan exclusion in Kaspersky Standard on Windows. Use the path to your own copy of ego.exe; the installation folder can differ.

1. Open Kaspersky Standard, then click the settings gear at the bottom left: Settings → Security settings.

   

2. The Security settings page opens at Basic protection. Scroll down to Advanced settings.

   

3. Select Advanced settings → Exclusions and actions on object detection. Older versions may call this Threats and Exclusions.

   

4. Select Exclusions → Manage exclusions.

   

5. In the Exclusions window, click Add.

   

6. Click Browse → select ego.exe from step 2. Under Protection components → Selected only, select Scan and File Anti-Virus. Set Status → Active, then click Add.

   

7. Check the new rule in Exclusions → Status → Enabled. The protection components should match your selection: Scan and File Anti-Virus.

   

Confirm with OK → Save if prompted. You can open each screenshot at full size to read the controls.

Specify trusted applications is a separate setting for application activity. Adding an application there does not stop Kaspersky from scanning its executable file.

Kaspersky's Threats and Exclusions help page explains the difference between trusted applications and exclusions.

Other antivirus products

• Norton: Settings > Antivirus > Scans and Risks > Items to Exclude from Scans. See Norton's guide.
• Bitdefender: Protection > Antivirus > Settings > Manage exceptions. If Advanced Threat Defense blocks ego.exe, add it there too. See antivirus exceptions as well as Advanced Threat Defense exceptions.
• ESET: Advanced setup (F5) > Detection engine > Exclusions > Performance exclusions. See ESET KB2769.
• Avast, AVG, McAfee, and others: look for Exceptions, Exclusions, Excluded files, or Trusted applications in the settings, or search the vendor's help center for how to exclude a file.

Menu names change between versions, so if a label above does not match what you see, follow the vendor's current guide.

Keep in mind:

• Add ego.exe itself, not a whole drive or your user folder, and keep your antivirus turned on.
• If an alert names a different file inside the ego(lite) folder, add that file the same way and let us know which one it was.
• If alerts come back after an ego(lite) update, check that the exception still points to ego.exe. Some products tie exceptions to a file's hash, which changes with every build.
• Once your antivirus vendor has fixed the detection, you can remove the exception.

Contact us

If an alert keeps coming back or you have questions, email support@citrolabs.ai with:

• your antivirus product and its version
• the detection name, exactly as the alert shows it
• your ego(lite) version
• a screenshot of the alert, if you have one

These details let us report the detection to the right vendor. You can also ask in our Discord community. Step-by-step instructions are also in the Windows docs.